TalkToWPTalkToWP
Log inStart Free
SoloOne WordPress site, watched and fixed for you.AgencyEvery client site in one fleet view.
NoticeboardCustomer storiesBlogFAQSecurity
Solo pricingAgency pricing
Log inStart Free
The noticeboard

WordPress security notices worth acting on.

When a widely used plugin, or WordPress itself, ships a security fix, it goes here: what is affected, which version fixes it, and what to do. Every notice is checked against its source (NVD, CISA, WPScan or the vendor) and dated the day that source published it.

  1. Update now

    Contact Form 7 6.2.4 fixes an unauthenticated file upload

    CVE-2026-114432 · CVSS 9.8

    Versions 6.2 to 6.2.3 are affected (CVSS 9.8); update to 6.2.4 or later.

  2. Core

    WordPress 7.1.4 fixes a core upgrade remote code execution flaw

    CVE-2026-119977 · CVSS 8.1

    Versions 4.7 to 7.1.3 are affected (CVSS 8.1) and CISA lists it as exploited; update to 7.1.4.

  3. Exploited

    Bricksforge 3.1.8.10 fixes an unauthenticated file upload

    CVE-2026-85097 · CVSS 9.8

    Versions up to 3.1.8.9 are affected (CVSS 9.8) and attacks began 7 Oct; update to 3.1.8.10 or later.

  4. Patched

    Ninja Forms 3.15.4 fixes a stored XSS in the admin

    CVE-2026-94504 · CVSS 7.2

    Versions up to 3.15.3 are affected (CVSS 7.2); update to 3.15.4 or later.

  5. Exploited

    wp2shell: WordPress 6.8.6, 6.9.5 and 7.0.2 fix a chained takeover

    CVE-2026-63030 · CVE-2026-60137 · CVSS 9.8

    Two chained core flaws let an attacker with no account run code on 6.9 to 7.0.1 (CVSS 9.8); 6.8 needs the SQL injection fix in 6.8.6. CISA added both to its exploited list on 21 Jul; update core now.