Tag: WordPress security
Ghostscript CVE-2026-39919: Check WordPress PDF Uploads
A Ghostscript flaw lets crafted PDFs corrupt memory when servers make thumbnails. How to check whether your WordPress site renders…
Google Flags Fake Author Profiles: 5 Checks for Your Site
Google now calls fake author profiles, such as AI headshots, made-up names and false credentials, a form of deception. What…
WordPress 7.1.3: Pending Spam Comments Could Carry XSS
WordPress 7.1.3 fixes 7 flaws, including a stored XSS on the Comments screen exploitable via pending comments. Update now and…
Phishing Tripled in Microsoft’s 2026 Report: 5 Site Checks
Phishing was the way in for 23% of intrusions in Microsoft’s 2026 Digital Defense Report, up from 7%. What AI…
Google’s September 2026 Spam Update: 6 Checks for Your Site
Google’s September 2026 spam update is rolling out through early October. Here’s what happened and six checks for comment spam,…
Gravity Forms CVE-2026-84434: Check Hidden Upload Fields
Gravity Forms 3.1.0.4 and older let anyone upload files through a hidden File Upload field (CVE-2026-84434, CVSS 9.8). Update to…
Visual Composer CVE-2026-12227: Are You on 45.16.1+?
Visual Composer 45.16.0 and older let unauthenticated attackers run files on your server (CVE-2026-12227). The fix shipped quietly in July.…
Elementor CVE-2026-62062: One Link Can Add an Admin
Elementor 4.3.0 and 4.3.1 let one clicked link create an admin account (CVE-2026-62062). Update to 4.3.2 and check for admins…
cPanel CVE-2026-87899: What WordPress Hosts Should Check
CVE-2026-87899 lets any cPanel login run code as root. Update cPanel to a fixed build, update WP Toolkit to 6.11.3…
Comment2Shell: Check WordPress Comments for CVE-2026-93485
Comment2Shell (CVE-2026-93485) lets an anonymous comment run script in an admin’s browser. Update to WordPress 7.1.1+, then sweep stored comments.
