WordPress

Everything InfoSec Ledger has reported about WordPress: 2 stories, newest first. Part of our Vulnerabilities coverage.

Vulnerabilities

CVSS 9.1: Blocksy Companion CVE-2026-107645 Enables Unauthenticated Vendor Account Creation via Nonce Bypass

A critical privilege escalation flaw in the Blocksy Companion WordPress plugin allows attackers to bypass security checks and create vendor accounts.

Oct 11, 2026

Vulnerabilities

CVSS 9.8: Convex Plugin v1.16.0 Object Injection Vulnerability Demands Immediate Admin Action

A CVSS 9.8 vulnerability in the Convex plugin allows object injection, affecting all versions up to 1.16.0 and requiring immediate attention from administrators.

Oct 10, 2026