Our news and updates

In MailerLite – Signup forms (official) component for WordPress versions 1.7.21 and earlier a medium severity vulnerability CVE-2026-3253 was detected. This vulnerability allows authenticated attackers to create or delete arbitrary signup forms. To address this issue, users should upgrade MailerLite – Signup forms (official) to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-3253.

In Custom Thank You Page for WooCommerce component for WordPress versions 1.1.2 and earlier a medium severity vulnerability CVE-2026-4806 was detected. This vulnerability allows unauthenticated attackers to export or reset the plugin’s settings. To address this issue, users should upgrade Custom Thank You Page for WooCommerce to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-4806.

In Keycloak affected versions a medium severity vulnerability CVE-2026-97311 was detected. This vulnerability allows an attacker to bypass group visibility permissions. To address this issue, users should upgrade Keycloak to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-97311.

In affected versions of the Ansible Automation Platform (AAP) gateway a medium severity vulnerability CVE-2026-94416 was detected. This vulnerability allows an authenticated administrator to create a new service key for the Controller service cluster. To address this issue, users should upgrade Ansible to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-94416.

In eesy_ID2WP – Publish InDesign HTML5 plugin component for WordPress versions 1.0.3 and earlier a high severity vulnerability CVE-2026-77193 was detected. This vulnerability allows unauthenticated attackers to read the contents of arbitrary files on the server. To address this issue, users should upgrade eesy_ID2WP – Publish InDesign HTML5 plugin to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-77193.

In YOP Poll component for WordPress versions 7.0.10 and earlier a high severity vulnerability CVE-2026-85682 was detected. This vulnerability allows unauthenticated attackers to take over an administrator’s account. To address this issue, users should upgrade YOP Poll to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-85682.

In Visual Composer Website Builder component for WordPress versions 45.16.0 and earlier a critical severity vulnerability CVE-2026-12227 was detected. This vulnerability allows unauthenticated attackers to include and execute arbitrary files on the server. To address this issue, users should upgrade Visual Composer Website Builder to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-12227.

In WP Multilang – Translation and Multilingual Plugin component for WordPress versions 2.4.31 and earlier a medium severity vulnerability CVE-2026-15731 was detected. This vulnerability allows authenticated attackers to inject arbitrary web scripts. To address this issue, users should upgrade WP Multilang – Translation and Multilingual Plugin to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-15731.

In the Kirki – Freeform Page Builder, Website Builder & Customizer component for WordPress versions 6.2.0 and earlier a medium severity vulnerability CVE-2026-18335 was detected. This vulnerability allows unauthenticated attackers to make web requests to arbitrary locations from the server. To address this issue, users should upgrade the Kirki plugin to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-18335.