rapid7

CVE-2026-107508: Unknown Ultimate Multisite: The Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file to…

The Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file to include, allowing unauthenticated attackers to include and read arbitrary local ...
x

Open-Source Projects on X: "• Browse plugins for Claude, Codex, Gemini, Grok • Check trust scores before installing • Validate plugins locally with plugin-scanner"

Discover open-source projects and developer tools worth exploring.

Ninja Forms plugin flaw exploited to hack WordPress sites

Hackers are exploiting stored cross-site scripting (XSS) vulnerabilities in two unrelated WordPress plugins, Ninja Forms and WPC Product Bundles for WooCommerce, to install backdoors and create rogue ...