Security News

Critical vulnerabilities, as they're published

We track newly-disclosed CVEs in CMS platforms, plugins, and e-commerce software — WordPress, Magento, WooCommerce and more — so you know when something could affect your website.

CRITICAL 9.3 CVE-2026-66680 20 Aug 2026

Locatoraid Store Locator SQL Injection

Unauthenticated SQL Injection in Locatoraid Store Locator <= 3.9.72 versions.

CRITICAL 9.8 CVE-2026-66672 20 Aug 2026

Flatastic PHP Object Injection

Unauthenticated PHP Object Injection in Flatastic <= 2.0 versions.

CRITICAL 9.3 CVE-2026-66649 20 Aug 2026

Directory Pro SQL Injection

Unauthenticated SQL Injection in Directory Pro <= 2.5.8 versions.

CRITICAL 9.3 CVE-2026-66609 20 Aug 2026

TheGem Elementor SQL Injection

Unauthenticated SQL Injection in TheGem (Elementor) <= 5.12.3 versions.

CRITICAL 9.1 CVE-2026-66600 20 Aug 2026

Media Library Assistant Arbitrary File Upload

Author Arbitrary File Upload in Media LIbrary Assistant <= 3.39 versions.

CRITICAL 9.3 CVE-2026-66593 20 Aug 2026

CleanTalk Security Plugin SQL Injection

Unauthenticated SQL Injection in Security & Malware scan by CleanTalk <= 2.184 versions.

CRITICAL 9.3 CVE-2026-66592 20 Aug 2026

WordPress rtMedia SQL Injection

Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 versions.

CRITICAL 9.8 CVE-2026-66583 20 Aug 2026

Forminator Plugin PHP Object Injection

Unauthenticated PHP Object Injection in Forminator <= 1.57.0 versions.

CRITICAL 9.3 CVE-2025-15688 20 Aug 2026

Capella 2.5.5 Unauthenticated SQL Injection

Unauthenticated SQL Injection in Capella <= 2.5.5 versions.

CRITICAL 9.8 CVE-2026-14950 20 Aug 2026

FDS Web Interface Session Hijacking Bug

An unauthenticated remote attacker in possession of a valid session identifier is able to continue using the session after it should have expired. This increases the risk associated with stolen, leaked, shared, or unattended sessions and may enable unauthorized continued access to the FDS web interface.

CRITICAL 9.8 CVE-2026-75860 20 Aug 2026

WordPress JSON Options Plugin Unauthenticated Privilege Escalation

The JSON Options WordPress plugin through 0.0.4 does not have any capability check or nonce verification on one of its actions, which runs on every request and is available to unauthenticated users, allowing them to update arbitrary WordPress options. This can be leveraged to enable user registration and set the default role to administrator, leading to privilege escalation and full site takeover.

CRITICAL 9.8 CVE-2026-63722 19 Aug 2026

ICEcoder 8.1 Remote Code Execution Bug

ICEcoder 8.1 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by chaining an authentication bypass, CSRF validation bypass, and unsanitized command execution. Attackers can send a single HTTP POST request to the terminal endpoint with a password parameter to bypass authentication, a non-empty csrf parameter to skip CSRF validation, and an arbitrary command string passed directly to proc_open

CRITICAL 9.9 CVE-2026-55089 19 Aug 2026

Etherpad OAuth Admin Privilege Escalation

Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad's src/node/handler/APIHandler.ts authorizes requests to /api/2/* in the authorization_code OAuth path by using requiredClaims with the admin claim. This check requires only that the claim exists, while src/node/security/OAuth2Provider.ts issues admin: false for configured non-admin users. A non-admin user with a valid signed token can therefore invoke administrative functions including setHTML, set

CRITICAL 9.6 CVE-2026-55085 19 Aug 2026

Etherpad Cross-Site Scripting (XSS) Vulnerability

Etherpad is a real-time collaborative editor. Prior to 3.3.1, result.appendSpan in src/static/js/domline.ts interpolates the start attribute of a numbered list directly into an unquoted ol start attribute before assigning the generated markup to node.innerHTML. ImportEtherpad.setPadRaw in src/node/utils/ImportEtherpad.ts accepts attacker-controlled attribute-pool values from a crafted .etherpad import, including list:number1 and a malicious start value. Any user with write ac

CRITICAL 9.8 CVE-2026-18315 19 Aug 2026

WordPress TrueBooker Plugin Authorization Bypass

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Account Takeover in all versions up to, and including, 1.2.6. This is due to the admin_user_create_cus AJAX handler lacking any authentication or capability check before passing the attacker-supplied truebooker_wp_user_id parameter directly to wp_update_user. This makes it possible for unauthenticated attackers to overwrit

CRITICAL 9.0 CVE-2026-32475 19 Aug 2026

Elementor Pro Unrestricted File Upload Vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1.

CRITICAL 9.8 CVE-2026-52889 19 Aug 2026

Craft CMS Formie Plugin Twig Injection

Formie is a Craft CMS plugin for creating forms. Prior to 3.1.27, Formie can pass request-derived Hidden field defaults such as HTTP User Agent, Referer URL, Current URL, Current URL without Query String, Query Parameter, and Cookie Value to Craft's Twig rendering layer during front-end form rendering. An unauthenticated attacker can place Twig syntax in one of these request-controlled inputs when a public form contains an affected Hidden field. Hidden::getFrontEndInputOption

CRITICAL 9.3 CVE-2026-73391 19 Aug 2026

Think your server has been compromised?

Tell us what happened. We'll review your request and provide an initial response within 1 hour.

Get Emergency Help help@myserverhacked.com