Current advisories, security updates and news around WordPress, e-commerce and hosting.https://jproxx.com/en-UShttps://jproxx.com/en/blog/security-bulletin-2026-07-13/https://jproxx.com/en/blog/security-bulletin-2026-07-13/A quiet start to the week: an unauthenticated SQL injection in the Booking Package plugin — reachable through an open REST endpoint, limited in exploitability by an email check and so far without a fix.Mon, 13 Jul 2026 00:00:00 GMTbulletinwordpresshttps://jproxx.com/en/blog/security-bulletin-2026-07-12/https://jproxx.com/en/blog/security-bulletin-2026-07-12/Weekend security roundup: a code execution in WP Ultimate CSV Importer, a local file inclusion in LA-Studio Element Kit, a cross-site scripting in Motors and an email manipulation in NEX-Forms.Sun, 12 Jul 2026 00:00:00 GMTbulletinwordpresshttps://jproxx.com/en/blog/security-bulletin-2026-07-11/https://jproxx.com/en/blog/security-bulletin-2026-07-11/Daily security roundup: an unauthenticated file read in W3 Total Cache, an account takeover in Essential Addons for Elementor, a leak of payment keys in Cost Calculator Builder and a file upload with code execution in the Joomla extension RSFiles!.Sat, 11 Jul 2026 00:00:00 GMTbulletinwordpressphphttps://jproxx.com/en/blog/security-bulletin-2026-07-10/https://jproxx.com/en/blog/security-bulletin-2026-07-10/Daily security roundup: a file upload with code execution in Super Forms, an authentication bypass in miniOrange Social Login, a SQL injection in Ultimate Member and a payment manipulation in SureForms.Fri, 10 Jul 2026 00:00:00 GMTbulletinwordpresshttps://jproxx.com/en/blog/security-bulletin-2026-07-09/https://jproxx.com/en/blog/security-bulletin-2026-07-09/Daily security roundup: an authentication bypass in miniOrange OTP, a file upload with code execution in Blocksy Companion Pro, a plugin installation via CSRF in Divi Torque and an account takeover in Divi Form Builder.Thu, 09 Jul 2026 00:00:00 GMTbulletinwordpresshttps://jproxx.com/en/blog/security-bulletin-2026-07-08/https://jproxx.com/en/blog/security-bulletin-2026-07-08/Daily security roundup: an unauthenticated plugin installation in WP Learn Manager, a payment bypass in LatePoint, an account takeover in Eventer and an unauthenticated SQL injection in My Calendar.Wed, 08 Jul 2026 00:00:00 GMTbulletinwordpresshttps://jproxx.com/en/blog/security-bulletin-2026-07-07/https://jproxx.com/en/blog/security-bulletin-2026-07-07/Daily security roundup: a supply-chain attack with a backdoor in Uncanny Automator Pro, an unauthenticated code execution in WPFunnels, a file deletion in Frontend File Manager and a file write in AMP for WP.Tue, 07 Jul 2026 00:00:00 GMTbulletinwordpresshttps://jproxx.com/en/blog/security-bulletin-2026-07-06/https://jproxx.com/en/blog/security-bulletin-2026-07-06/Daily security roundup: a critical command injection in widely used file manager plugins, a file upload in FileOrganizer, an unauthenticated privilege escalation in Admin and Site Enhancements and cross-site scripting in Simple Membership.Mon, 06 Jul 2026 00:00:00 GMTbulletinwordpresshttps://jproxx.com/en/blog/security-bulletin-2026-07-05/https://jproxx.com/en/blog/security-bulletin-2026-07-05/Security roundup: a critical NoSQL injection in the cve-search tool, an OIDC account takeover in Keycloak and a cluster of SQL injection flaws in small PHP demo applications.Sun, 05 Jul 2026 00:00:00 GMTbulletininfrastructurephphttps://jproxx.com/en/blog/security-bulletin-2026-07-04/https://jproxx.com/en/blog/security-bulletin-2026-07-04/Daily security roundup: a privilege escalation leading to server takeover in the HestiaCP control panel, a heap overflow in PHP core, stored cross-site scripting in Ultimate Member and unauthenticated tampering with customer data in LatePoint.Sat, 04 Jul 2026 00:00:00 GMTbulletinphpwordpresshttps://jproxx.com/en/blog/security-bulletin-2026-07-03/https://jproxx.com/en/blog/security-bulletin-2026-07-03/Daily security roundup: a login-free stored cross-site scripting flaw in the wpDiscuz comment plugin, an unauthenticated file read in AR for WooCommerce and a stored cross-site scripting flaw in the NEX-Forms plugin.Fri, 03 Jul 2026 00:00:00 GMTbulletinwordpresshttps://jproxx.com/en/blog/security-bulletin-2026-07-02/https://jproxx.com/en/blog/security-bulletin-2026-07-02/Daily security roundup: a critical, login-free code execution in Divi Form Builder, an unauthenticated file deletion in the Printcart WooCommerce plugin, an unauthenticated file read in the Ninja Forms File Uploads add-on and a file deletion in the Image Optimizer plugin by Elementor.Thu, 02 Jul 2026 00:00:00 GMTbulletinwordpresshttps://jproxx.com/en/blog/security-bulletin-2026-07-01/https://jproxx.com/en/blog/security-bulletin-2026-07-01/Daily security roundup: a critical, login-free privilege escalation in the PrivateContent plugin, an unauthenticated file deletion in the Business Directory Plugin, an SQL injection in the BookingPress appointment plugin and cross-site scripting in the widely used Enable Media Replace.Wed, 01 Jul 2026 00:00:00 GMTbulletinwordpresshttps://jproxx.com/en/blog/webserver-caching/https://jproxx.com/en/blog/webserver-caching/How HTTP caching really works — where caches live, the freshness model, setting Cache-Control correctly, revalidation with ETag, the Vary header and a practical strategy for static files, HTML and protected content.Wed, 01 Jul 2026 00:00:00 GMTinfrastructurehttps://jproxx.com/en/blog/security-bulletin-2026-06-30/https://jproxx.com/en/blog/security-bulletin-2026-06-30/Daily security roundup: a critical, login-free SQL injection in the EventON calendar, an unauthenticated account takeover in ProfileGrid and a deserialization flaw with file deletion in Export User Data.Tue, 30 Jun 2026 00:00:00 GMTbulletinwordpresshttps://jproxx.com/en/blog/security-bulletin-2026-06-29/https://jproxx.com/en/blog/security-bulletin-2026-06-29/Daily security roundup: a critical, login-free account takeover in the Invoice Generator plugin, an IDOR authorization flaw in the ProfilePress membership plugin and stored cross-site scripting in the widely used SiteOrigin Page Builder.Mon, 29 Jun 2026 00:00:00 GMTbulletinwordpresshttps://jproxx.com/en/blog/security-bulletin-2026-06-28/https://jproxx.com/en/blog/security-bulletin-2026-06-28/Daily security roundup: actively exploited RCE in the Breeze WordPress cache plugin, an authentication bypass in Burst Statistics and an unauthenticated flaw in WP Travel Engine.Sun, 28 Jun 2026 00:00:00 GMTbulletinwordpresshttps://jproxx.com/en/blog/security-bulletin-2026-06-27/https://jproxx.com/en/blog/security-bulletin-2026-06-27/An unprotected REST endpoint in the Gravity SMTP WordPress plugin exposes API keys and tokens (CVE-2026-4020). Fixed back in March in 2.1.5, mass-exploited in June.Sat, 27 Jun 2026 00:00:00 GMTwordpresscvehttps://jproxx.com/en/blog/security-bulletin-2026-06-26/https://jproxx.com/en/blog/security-bulletin-2026-06-26/Daily security overview: critical flaws in Avada Builder and RD Station, plus a status follow-up on two WordPress plugins that remain unpatched.Fri, 26 Jun 2026 00:00:00 GMTbulletinwordpresshttps://jproxx.com/en/blog/security-bulletin-2026-06-25/https://jproxx.com/en/blog/security-bulletin-2026-06-25/Daily security overview: a CRLF injection in the Laravel PHP framework and a critical, unauthenticated account takeover in the Kirki WordPress plugin.Thu, 25 Jun 2026 00:00:00 GMTbulletinphpwordpresshttps://jproxx.com/en/blog/security-bulletin-2026-06-24/https://jproxx.com/en/blog/security-bulletin-2026-06-24/Daily security overview: two flaws in the WP Activity Log audit plugin and an unauthenticated SQL injection in The Events Calendar.Wed, 24 Jun 2026 00:00:00 GMTbulletinwordpresshttps://jproxx.com/en/blog/guzzle-php-http-client-2026-06/https://jproxx.com/en/blog/guzzle-php-http-client-2026-06/Two vulnerabilities in the widely used Guzzle PHP HTTP client: unencrypted proxy traffic and a CookieJar flaw. Both are fixed in version 7.12.1.Tue, 23 Jun 2026 00:00:00 GMTphpcvehttps://jproxx.com/en/blog/security-bulletin-2026-06-23/https://jproxx.com/en/blog/security-bulletin-2026-06-23/Daily security overview for WordPress and PHP: a SQL injection in Infility Global and two WordPress plugin flaws that are not yet patched.Tue, 23 Jun 2026 00:00:00 GMTbulletinwordpresshttps://jproxx.com/en/blog/security-bulletin-2026-06-22/https://jproxx.com/en/blog/security-bulletin-2026-06-22/Daily security overview for WordPress, e-commerce and PHP: privilege escalation in Vitepos, a flaw in PhpSpreadsheet, and XSS in WooCommerce Auction Pro.Mon, 22 Jun 2026 00:00:00 GMTbulletinwordpressphphttps://jproxx.com/en/blog/updraftplus-cve-2026-10795/https://jproxx.com/en/blog/updraftplus-cve-2026-10795/Critical, actively exploited flaw in the WordPress backup plugin UpdraftPlus (CVE-2026-10795): versions up to 1.26.4 affected — update to 1.26.5 now.Mon, 22 Jun 2026 00:00:00 GMTwordpresscvehttps://jproxx.com/en/blog/eigener-ki-coding-stack/https://jproxx.com/en/blog/eigener-ki-coding-stack/How we run Qwen3.6-35B as a coding assistant on our own hardware — vLLM, FP8, 256K context, speculative decoding. With real measurements from live operation.Sun, 21 Jun 2026 00:00:00 GMTaiinfrastructure