Threat feed
We follow new vulnerabilities in PHP, WordPress and popular software and break them down briefly: what happened, who is affected, how to check and fix. For some threats Shield can check your site from outside; for the rest we say plainly that you can only check on your own server.
What the badges mean
✅ Checked by Shield Shield already looks for this in site checks: it will find it and show it in the report.
⏳ Not checked yet Not visible from outside yet, or not added to the checks: check it yourself using the note.
Check your site in Shield →
FunnelKit Automations: untrusted deserialization (CVE-2026-39738)
WordPress Core: remote code execution during core upgrades (CVE-2026-119977)
PDF Invoice for WooCommerce: PHP Object Injection (CVE-2026-109220)
Project Manager for WordPress: remote code execution (CVE-2026-116512)
Gravity Forms: PHP Object Injection (CVE-2026-103039)
WordPress Core: remote code execution flaw (no CVE assigned)
libxml2: use-after-free when parsing XPath in Schematron (CVE-2025-49794)
Frontend Dashboard and ProfileGrid: PHP object injection (CVE-2026-103693)
Chat AI with Dispatcher: arbitrary file upload (CVE-2026-115245)
WordPress: unauthenticated RCE in the core update process (fixed in 7.1.4)
Jupiter X Core: authentication bypass via Twitter/X login (CVE-2026-106013)
Pie Register Premium: unauthenticated unrestricted file upload (CVE-2026-84999)
