NewsDark Reading20.07.2026

'WP2Shell' Opens Millions of WordPress Sites to Remote Takeover

Teaser from the source

Barely three days after disclosure, attackers are widely chaining together CVE-2026-60137 and CVE-2026-63030 to lob exploit attempts against one of the largest attack surfaces on the Internet.

This is the RSS-feed teaser. Read the full article at the original source.

Read at Dark Reading

Affected vendors and products

Other advisories

HighCVE-2026-116753The Multi Step for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'multipart field name (array key)' parameter in a…
HighCVE-2026-120687FooPlugins Lightbox & Modal Popup WordPress Plugin: Cross-Site-Scripting (XSS)
HighCVE-2026-120687FooPlugins Lightbox & Modal Popup WordPress Plugin: Cross-Site-Scripting (XSS)
MediumCVE-2026-127115The BuddyForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'buddyforms_form_content' parameter in all versions up to, and inclu…
HighCVE-2026-120687The Lightbox & Modal Popup WordPress Plugin – FooBox plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'img alt attribute i…
MediumCVE-2026-110531The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fv_player_videos' parameter in all versions up to, and including, …
CriticalCVE-2026-19907The Shipo plugin for WordPress is vulnerable to Authentication Bypass in versions 1.6 through 1.8.0. This is due to the `authenticate_rest_user()` function p…
HighCVE-2026-18053The MemberDash plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.8.7. This is due to a mass-assignment vulne…

Other news entries

Source: https://www.darkreading.com/cyberattacks-data-breaches/wp2shell-millions-wordpress-sites-remote-takeover

Affected vendors and products

More on WordPress

Other advisories

Other news entries