On October 7, 2026, the team behind Events Manager — one of WordPress’s most widely used event-management plugins — shipped version 7.4.7 as an emergency security release. The update closes an authenticated SQL injection vulnerability in the plugin’s REST API that, according to the official announcement, sat undetected in the code since version 7.3. Patchstack, … Read more
If your site runs Ninja Forms — the free contact-form plugin on more than 500,000 WordPress sites — this week’s security news is directly about you. Attackers have been actively exploiting a stored cross-site scripting flaw (CVE-2026-94504) in Ninja Forms since October 5, 2026, according to research published by WordPress security firm Patchstack. The same … Read more
WordPress 7.1.3 is a security release that patches seven vulnerabilities and four bugs. Here is a plain-English breakdown of the WordPress 7.1.3 security update — what each fix means for your site, plus a safe 15-minute update checklist so you can patch without breaking anything. What WordPress 7.1.3 actually fixed WordPress’s official 7.1.3 release notes … Read more
The WordPress 7.1.1 security update did something unusual: it closed eleven vulnerabilities at once — and buried in the middle was an attack chain with a name, a logo-worthy headline, and a two-line fix. Security researchers dubbed it “Click2Shell,” and it could have let an attacker take over a website after a single click by … Read more
Introduction Four widely used WordPress plugins were found to contain critical authentication-bypass flaws — all rated CVSS 9.8, the highest severity — disclosed on October 1, 2026. Each flaw lets an attacker who has never logged into your site take over an administrator account, with no password required. If your small business runs on WordPress, … Read more
If your business website runs on WordPress, this is one alert worth stopping for. A critical vulnerability in WordPress core is being actively exploited right now — no login required — and on September 25, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities (KEV) catalog, the list … Read more
