by Ivan Sorkin | Mar 10, 2026 | Core
Attack Vectors WordPress (wordpress) versions 6.9 through 6.9.1 are affected by CVE-2026-3906, rated Medium severity (CVSS 4.3). The primary attack path is through the WordPress REST API. An attacker must be authenticated with at least Subscriber-level access (or any...
by Ivan Sorkin | Mar 10, 2026 | Plugins
Attack Vectors High severity Stored Cross-Site Scripting (XSS) has been identified in the Lead Form Builder & Contact Form WordPress plugin (Responsive Contact Form Builder & Lead Generation Plugin) up to version 2.0.1 (CVE-2026-1454, CVSS 7.2). The primary...
by Ivan Sorkin | Mar 10, 2026 | Core
Attack Vectors This medium-severity issue (CVSS 4.3) affects WordPress core versions up to and including 6.9.1. It can be exploited by an authenticated user with at least Author-level access (i.e., someone who can log in and create/edit content). An attacker can use...
by Ivan Sorkin | Mar 10, 2026 | Plugins
Attack Vectors CVE-2026-1708 is a High-severity vulnerability (CVSS 7.5) affecting the WordPress plugin Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin (slug: simply-schedule-appointments) in versions up to and including 1.6.9.27. The issue...
by Ivan Sorkin | Mar 10, 2026 | Plugins
Attack Vectors CVE-2026-2917 is a Medium severity vulnerability (CVSS 5.4) affecting the Happy Addons for Elementor WordPress plugin (happy-elementor-addons) in versions up to and including 3.21.0. It can be exploited remotely over the network by an authenticated user...
Recent Comments