Latest WordPress news

WordPress vulnerability digest for April 8–9: 17 new CVEs, with one CVSS 9.8 critical that turns a GDPR compliance helper into an unauthenticated RCE primitive. The DSGVO Google Web Fonts GDPR plugin has no patched version and should be removed …

88 new CVEs on March 31 include a CVSS 10.0 NocoBase sandbox escape to root RCE, a WordPress Everest Forms Pro RCE, five baserCMS command injections, and SQL injections in Umami and SciTokens. Eleven vulnerabilities scored 9.0 or above.

A weekend batch of 198 CVEs includes a BACnet plaintext flaw (CVSS 9.1) exposing building automation to traffic interception. WordPress gets hit with five privilege escalation bugs, cookie-based SQL injection bypassing WAFs, and a strpos() admin takeover.

Three critical WordPress plugin flaws, all unpatched. A WooCommerce privilege escalation, a BuilderPress file inclusion, and a Profile Builder Pro SQL injection. Plus five OpenClaw command injections and a PX4 drone autopilot crash via MAVLink.

Five critical vulnerabilities lead the March 14-15 batch of 215 new CVEs. A CVSS 9.8 unauthenticated WordPress RCE, OneUptime's fourth CVSS 9.9 in six weeks, and three unpatched D-Link buffer overflows top the list.

An unauthenticated file upload in the WordPress Pix for WooCommerce plugin scored CVSS 9.8, and OneUptime collected its fourth critical vulnerability in two weeks. The March 14 digest covers 10 high-severity flaws including two Chrome zero-days.

420 new CVEs dropped on March 11, with three scoring critical. A WordPress LMS auth bypass (CVSS 9.8) threatens 30,000 sites, a gas station system has unauthenticated RCE, and Fortinet disclosed 11 flaws including an MFA bypass.