Tag: Patchstack
One click on a crafted link can seize an Elementor site
A CSRF flaw in the Elementor website builder lets a single link create a rogue administrator account on millions of…
A single line break turned a WordPress comment into a server shell
An anonymous commenter could plant a script that ran in an administrator's browser and, from there, uploaded a web shell…
Patch rush for five WordPress add-ons after takeover-grade flaws
Five critical flaws across WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP open sites to takeover and code execution.
SAML plugin bugs hand WordPress admin access to strangers
Two unauthenticated bugs in the miniOrange SAML plugin let attackers log in as any WordPress user.
WordPress page builder flaw turns file forms into remote code execution
Patchstack warns that a CVSS 9.0 flaw in Elementor Pro lets unauthenticated attackers upload PHP files and take over sites.