SQLi flaw in Elementor Ally plugin impacts 250k+ WordPress sites
An SQL injection vulnerability in Ally, a WordPress plugin from Elementor for…
WordPress membership plugin bug exploited to create admin accounts
Hackers are exploiting a critical vulnerability in the User Registration & Membership…
WordPress plugin with 900k installs vulnerable to critical RCE flaw
A critical vulnerability in the WPvivid Backup & Migration plugin for WordPress,…
ACF plugin bug gives hackers admin on 50,000 WordPress sites
A critical-severity vulnerability in the Advanced Custom Fields: Extended (ACF Extended) plugin…
GootLoader Malware Uses 500–1,000 Concatenated ZIP Archives to Evade Detection
Jan 16, 2026Ravie LakshmananMalvertising / Threat Intelligence The JavaScript (aka JScript) malware…
Hackers exploit Modular DS WordPress plugin flaw for admin access
Hackers are actively exploiting a maximum severity flaw in the Modular DS WordPress…
Long-Running Web Skimming Campaign Steals Credit Cards From Online Checkout Pages
Jan 13, 2026Ravie Lakshmanan Web Security / Data Theft Cybersecurity researchers have…
GootLoader Is Back, Using a New Font Trick to Hide Malware on WordPress Sites
Nov 11, 2025Ravie LakshmananMalware / Network Security The malware known as GootLoader…
Hackers exploit critical auth bypass flaw in JobMonster WordPress theme
Threat actors are targeting a critical vulnerability in the JobMonster WordPress theme…