plugin vulnerability

Events Manager 7.4.7 Security Update: Update Your Plugin Now

by
Computer terminal screen illustrating the Events Manager 7.4.7 security update

On October 7, 2026, the team behind Events Manager — one of WordPress’s most widely used event-management plugins — shipped version 7.4.7 as an emergency security release. The update closes an authenticated SQL injection vulnerability in the plugin’s REST API that, according to the official announcement, sat undetected in the code since version 7.3. Patchstack, … Read more

Ninja Forms Hack 2026: Attackers Plant Hidden Admins on WordPress Sites

by
Ninja Forms hack October 2026 — dark computer screen showing malicious code targeting WordPress sites

If your site runs Ninja Forms — the free contact-form plugin on more than 500,000 WordPress sites — this week’s security news is directly about you. Attackers have been actively exploiting a stored cross-site scripting flaw (CVE-2026-94504) in Ninja Forms since October 5, 2026, according to research published by WordPress security firm Patchstack. The same … Read more