Threat feed

We follow new vulnerabilities in PHP, WordPress and popular software and break them down briefly: what happened, who is affected, how to check and fix. For some threats Shield can check your site from outside; for the rest we say plainly that you can only check on your own server.

All 91 Articles 49 News 42 Threats 28

All notes ✅ Checked by Shield · Checked only Check your site in Shield

What the badges mean

✅ Checked by Shield Shield already looks for this in site checks: it will find it and show it in the report.

⏳ Not checked yet Not visible from outside yet, or not added to the checks: check it yourself using the note.

Check your site in Shield →

October 25, 2026 🔴 Critical ✅ Checked by Shield

Booster for WooCommerce: customer arbitrary file upload (CVE-2026-56027)

October 25, 2026 🔴 Critical ✅ Checked by Shield

BuddyBoss Platform: Subscriber PHP Object Injection (CVE-2026-56032)

October 25, 2026 🔴 Critical ✅ Checked by Shield

Page Builder CK for Joomla: unauthenticated file upload (CVE-2026-56290)

October 24, 2026 🔴 Critical ✅ Checked by Shield

WooCommerce Product Filters: unauthenticated PHP Object Injection (CVE-2026-40725)

October 24, 2026 🔴 Critical ✅ Checked by Shield

DJ-Classifieds for Joomla: unauthenticated file upload (CVE-2026-61424)

October 24, 2026 🔴 Critical ✅ Checked by Shield

Aimogen Pro: unauthenticated privilege escalation (CVE-2026-15982)

October 23, 2026 🔴 Critical ✅ Checked by Shield

Active Products Tables for WooCommerce: unauthenticated SQL injection (CVE-2026-66436)

October 23, 2026 🔴 Critical ✅ Checked by Shield

Forminator Forms: arbitrary file upload (CVE-2026-15748)

October 23, 2026 🔴 Critical ✅ Checked by Shield

Thrive Apprentice: unauthenticated PHP object injection (CVE-2026-49107)

October 21, 2026 🔴 Critical ✅ Checked by Shield

PHP2Shell: a critical flaw in PHP itself (CVE-2026-109618, CVE-2026-109619)