News

Two vulnerabilities have been reported in the All in One SEO (AIOSEO) WordPress plugin, which has more than two million active installations. The flaws could let unauthenticated attackers trigger shortcodes or inject scripts in specific circumstances. Both have been patched, and site owners should check their installed version as part of routine WordPress maintenance. Key…

Read More

Automattic, the company behind WordPress, has applied for 16 new top-level domains, ranging from .craft and .story to .matt, the first name of founder Matt Mullenweg. The applications could broaden the company’s domain portfolio beyond .blog, which has around 375,000 registrations. The proposed names are not yet confirmed as available for public use. Key takeaways…

Read More

Hackers are exploiting flaws in Ninja Forms and WPC Product Bundles for WooCommerce to gain persistent access to WordPress websites. The attacks use malicious scripts hidden in form submissions or order data, where they can run when an administrator views the content. Site owners should update both plugins and check for signs of an existing…

Read More

A cybercrime toolkit called TIKTOUK has been designed to find exposed WordPress files and recover credentials stored on vulnerable sites. Researchers found a leaked control panel holding around 50,000 server-side credentials linked to roughly 37,000 domains, including hundreds of AWS keys reported as active. The findings underline why secure backups and routine WordPress maintenance matter.…

Read More

A critical flaw in WordPress was targeted within hours of a security update, prompting the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add it to its Known Exploited Vulnerabilities catalog. The bug could enable remote code execution on affected sites under specific conditions. Website owners should check their versions and apply the relevant fix…

Read More

Automattic, the company behind WordPress.com, Tumblr and WooCommerce, has reportedly reshaped its board and leadership after directors attempted to place CEO Matt Mullenweg on leave. Mullenweg is said to have regained control within roughly 33 hours. The upheaval comes as the company faces a high-profile legal dispute with hosting provider WP Engine. Key takeaways Automattic’s…

Read More

Cloudflare has moved its main blog from WordPress to EmDash, a content management system it developed in-house. The company says the new setup delivers more consistent performance during traffic spikes and tested successfully at up to 7,000 requests per second. Its gradual rollout also offers useful lessons for teams maintaining high-traffic websites. Key takeaways Cloudflare’s…

Read More

Two disclosed vulnerabilities in The Events Calendar plugin could let attackers run code on affected WordPress sites without logging in. Both flaws involve event comments processed during page rendering, but use different technical routes. Site owners should check their plugin version, confirm a fix for both issues is installed and review comment settings while they…

Read More

A supply-chain attack involving Brevo-hosted scripts exposed more than 100,000 websites to malicious code on 14 September. The attackers used the compromised resources to target WordPress administrators with a plugin upload attempt and show other visitors a fake verification prompt. Researchers say the incident highlights how a single trusted supplier can put many sites at…

Read More