CVE Watch

A web form with one list row glowing amber sends a cube marked with the PHP elephant toward two pipes; a blue shield blocks the upper pipe, while an amber arrow enters the open, older lower pipe

CVE Watch Nov 3, 2026

Gravity Forms CVE-2026-103039: One Missed Call, a 9.8, and Who’s Actually Exposed

A browser window squeezed in a metal press, with a row of blue percent-sign tokens; one amber token is cracked open and a dotted amber line runs from it to an image icon

CVE Watch Oct 29, 2026

LiteSpeed Cache CVE-2026-116763: Two Stored XSS Bugs, Two Settings to Check

CVE Watch Oct 28, 2026

ACF Extended CVE-2026-94267: Five Front-End Form Flaws, One Root Cause

A storefront web page with an upload box as a red code file flies into it, beside a checklist that ticks image files and marks a code file with a red X, with a shopping cart and a warning sign

CVE Watch Oct 27, 2026

Wholesale Lead Capture CVE-2026-27540: Patched in February, Attacked All Summer

A red code file following an empty dashed file into a web upload form, with a warning sign and red cracks spreading across the server stack behind it

CVE Watch Oct 27, 2026

Elementor Pro CVE-2026-32475: Form Uploads Turned Into Site Takeovers

A cloud dashboard holding a key, connected to many WordPress sites, while a hand takes a glowing red copy of the key and red bug icons appear on some of the connections

CVE Watch Oct 23, 2026

UpdraftCentral Breach: Stolen Keys Used to Backdoor WordPress Sites

An image tag going into a gear-driven machine and coming out the other side cracked open, with an orange code symbol breaking out of it

CVE Watch Oct 22, 2026

WebP Express CVE-2026-97328: When the HTML Parser Writes the Attack

A cookie feeding into a web page with a code symbol, which passes to a server and is copied out to many other web pages

CVE Watch Oct 22, 2026

PixelYourSite CVE-2026-109987: Your Page Cache Serves the Attack

A cracked stone PHP elephant carrying blocks for WordPress, plugins and a shopping cart, with red cracks running from a torn envelope stamped confidential

CVE Watch Oct 21, 2026

PHP2Shell: Two Critical PHP Flaws Leaked Before the Patch

A cracked WordPress cube held together with glowing blue patches and one orange patch, tagged with version 7.1.3

CVE Watch Oct 20, 2026

WordPress 7.1.3: Seven Core Security Fixes, Explained