Everything Phish Herald has reported about WordPress: 5 stories, newest first. Part of our Vulnerabilities coverage.
Organisations should review the latest Wordfence Intelligence data on WordPress flaws disclosed between 28 September and 4 October 2026.
A critical vulnerability in Stylemix uListing versions up to 2.2.0 allows unauthenticated SQL injection, posing severe risks to website data integrity.
A critical vulnerability in ThemeREX IPharm versions up to 1.2.4 allows untrusted data deserialization, posing a severe risk to WordPress installations.
A critical flaw in Avada Builder allows attackers to delete site content and trigger code execution without logging in, affecting versions up to 7.16.1.
A critical privilege escalation in the Blocksy Companion plugin allows unauthenticated users to bypass security checks and gain seller access on WordPress sites.