Vulnerabilities
Organisations at Risk: CVSS 9.8 CVE-2026-109892 in Frontend Admin 3.29.13 Allows Privilege Escalation
A critical vulnerability in the Frontend Admin plugin allows privilege escalation, affecting all versions up to 3.29.13.
WordPress
Everything Patch Observer has reported about WordPress: 6 stories, newest first. Part of our Vulnerabilities coverage.
Vulnerabilities
MSPs Face Critical Fluent CRM Risk as Privilege Escalation Flaw Lacks Confirmed Fix
A critical flaw in Fluent CRM versions up to 3.2.5 allows privilege escalation. MSPs must assess exposure immediately as the source material does not confirm a fix.
Vulnerabilities
Managed Service Providers Urged to Patch Critical itthinx Affiliates Deserialization Vulnerability
A critical deserialization vulnerability in itthinx Affiliates versions up to 7.0.1 allows object injection, requiring immediate attention for managed service providers.
Vulnerabilities
WordPress AGE-GATE Plugin CVE-2026-104800 Lets Attackers Run Code Without Login
All versions of the WordPress AGE-GATE plugin through 1.0 contain a critical flaw that lets attackers run code on servers without logging in.
Vulnerabilities
Bricksforge Wild RCE Forces Orgs to Patch to 3.1.8.10 Amid Active CVE-2026-85097 Attacks
Patchstack confirms active wild exploitation of CVE-2026-85097 in Bricksforge versions up to 3.1.8.9, requiring immediate updates.
Vulnerabilities
Axiomthemes Veto Object Injection Flaw Puts WP Sites at Critical Risk Up to v1.6.0
The NVD rates CVE-2026-93927 as critical, warning that Axiomthemes Veto versions up to 1.6.0 allow object injection through untrusted data.