Our news and updates

In Notifications for Forms & WordPress Actions component for WordPress versions before 2.6 a high severity vulnerability CVE-2024-6228 was detected. This vulnerability allows authenticated users with subscriber-level access to include and execute arbitrary local PHP files. To address this issue, users should upgrade Notifications for Forms & WordPress Actions to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-6228.

In AllCoach component for WordPress versions before 1.0.2 a high severity vulnerability CVE-2026-10830 was detected. This vulnerability allows unauthenticated attackers to reset the password of arbitrary accounts and take over the site. To address this issue, users should upgrade AllCoach to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-10830.

In Ultimate Member component for WordPress versions before 2.12.0 a high severity vulnerability CVE-2026-11766 was detected. This vulnerability allows authenticated users with Subscriber-level access to store and execute malicious JavaScript on user profiles. To address this issue, users should upgrade Ultimate Member to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-11766.

In Simple Membership component for WordPress versions before 4.7.5 a high severity vulnerability CVE-2026-11855 was detected. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts. To address this issue, users should upgrade Simple Membership to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-11855.

In TinyPNG – JPEG, PNG & WebP image compression component for WordPress versions 3.6.13 and earlier a high severity vulnerability CVE-2026-7311 was detected. This vulnerability allows authenticated attackers to delete arbitrary files on the server, which can lead to remote code execution. To address this issue, users should upgrade TinyPNG – JPEG, PNG & WebP image compression to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-7311.

In Weaviate versions before 1.38.0 a high severity vulnerability CVE-2026-59093 was detected. This vulnerability allows an attacker to escalate their privileges. To address this issue, users should upgrade Weaviate to version 1.38.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-59093.

In weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot component for WordPress versions 2.3.0 and earlier a medium severity vulnerability CVE-2026-12729 was detected. This vulnerability allows attackers to execute sensitive operations without proper authorization. To address this issue, users should upgrade weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-12729.

In Forgejo versions before 15.0.3 a medium severity vulnerability CVE-2026-59102 was detected. This vulnerability allows authenticated attackers to execute arbitrary JavaScript in other users’ browsers. To address this issue, users should upgrade Forgejo to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-59102.

In Plane versions 4.6.3 and earlier a critical severity vulnerability CVE-2026-38971 was detected. This vulnerability allows an attacker to access sensitive information or cause a denial of service. To address this issue, users should upgrade Plane to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-38971.