Skip to main content

Easy Form Builder by WhiteStudio WordPress Plugin Allows Unauthenticated Full Administrator Takeover (CVE-2026-13439)

Scope: Easy Form Builder by WhiteStudio WordPress Plugin Versions up to and Including 4.0.

Elementor Website Builder REST API Authorization Bypass Exposes Private Posts and Draft Content (CVE-2026-8825)

Scope: Elementor Website Builder Plugin Versions Prior to 4.1.4

Essential Addons for Elementor Stored XSS via Fancy Text Widget Allows Session Hijacking (CVE-2026-15145)

Scope: Essential Addons for Elementor WordPress Plugin Versions up to and Including 6.6.1

WordPress Core Pre-Authentication RCE Chain "wp2shell" Now Has Public Exploits (CVE-2026-63030 / CVE-2026-60137)

Scope: WordPress Core Versions 6.8.0 through 6.8.5 (SQL injection only), 6.9.0 through 6.

VentraConnect WordPress Plugin OTP Brute Force Enables Unauthenticated Administrator Account Takeover (CVE-2026-13142)

Scope: Social Login, Passkeys, Magic Link and Email OTP WordPress Plugin (VentraConnect)

WSO2 API Manager and Identity Server Reflected XSS Enables Session Manipulation and Credential Theft (CVE-2026-2445)

Scope: WSO2 API Manager 4.2.0 to 4.6.0 and WSO2 Identity Server 6.0.0 and 7.1.0 (Multiple

FreeRDP Pre-Authentication Heap Buffer Overflow Enables Remote Code Execution Against RDP Clients (CVE-2026-64620)

Scope: FreeRDP Versions 3.27.1 and Earlier (Linux, macOS, Windows, Android Clients)

Subscribe to Advisories