CVE Alert: CVE-2026-93428 - ultimatemember - Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin - https://www.redpacketsecurity.com/cve-alert-cve-2026-93428-ultimatemember-ultimate-member-user-profile-registration-login-member-directory-content-restriction-membership-plugin/
RedPacket Security
CVE Alert: CVE-2026-93428 - ultimatemember - Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction…
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to
CVE Alert: CVE-2026-92977 - devowl - Real Cookie Banner: GDPR & ePrivacy Cookie Consent - https://www.redpacketsecurity.com/cve-alert-cve-2026-92977-devowl-real-cookie-banner-gdpr-eprivacy-cookie-consent/
RedPacket Security
CVE Alert: CVE-2026-92977 - devowl - Real Cookie Banner: GDPR & ePrivacy Cookie Consent - RedPacket Security
The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up
CVE Alert: CVE-2026-92536 - properfraction - Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress - https://www.redpacketsecurity.com/cve-alert-cve-2026-92536-properfraction-paid-membership-plugin-ecommerce-user-registration-form-login-form-user-profile-restrict-content-profilepress/
RedPacket Security
CVE Alert: CVE-2026-92536 - properfraction - Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile…
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is
[WALLSTREET] - Ransomware Victim: World Cup 2034 - https://www.redpacketsecurity.com/wallstreet-ransomware-victim-world-cup-2034/
RedPacket Security
[WALLSTREET] - Ransomware Victim: World Cup 2034 - RedPacket Security
NOTE: No files or stolen information are exfiltrated, downloaded, taken, hosted, seen, reposted, or disclosed by RedPacket Security. Any legal issues relating
[WALLSTREET] - Ransomware Victim: St[.] Francis Healthcare Systems of Hawaii - https://www.redpacketsecurity.com/wallstreet-ransomware-victim-st-francis-healthcare-systems-of-hawaii/
RedPacket Security
[WALLSTREET] - Ransomware Victim: St[.] Francis Healthcare Systems of Hawaii - RedPacket Security
NOTE: No files or stolen information are exfiltrated, downloaded, taken, hosted, seen, reposted, or disclosed by RedPacket Security. Any legal issues relating
CVE Alert: CVE-2026-97644 - trainingbusinesspros - Groundhogg — CRM, Newsletters, and Marketing Automation - https://www.redpacketsecurity.com/cve-alert-cve-2026-97644-trainingbusinesspros-groundhogg-crm-newsletters-and-marketing-automation/
RedPacket Security
CVE Alert: CVE-2026-97644 - trainingbusinesspros - Groundhogg — CRM, Newsletters, and Marketing Automation - RedPacket Security
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation via Contact Identity Rebinding in all
CVE Alert: CVE-2026-103913 - paoltaia - GeoDirectory – WP Business Directory Plugin and Classified Listings Directory - https://www.redpacketsecurity.com/cve-alert-cve-2026-103913-paoltaia-geodirectory-wp-business-directory-plugin-and-classified-listings-directory/
RedPacket Security
CVE Alert: CVE-2026-103913 - paoltaia - GeoDirectory – WP Business Directory Plugin and Classified Listings Directory - RedPacket…
The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the stored latitude/longitude coordinates of a listing in versions up to, and
CVE Alert: CVE-2026-87091 - uscnanbu - Welcart e-Commerce - https://www.redpacketsecurity.com/cve-alert-cve-2026-87091-uscnanbu-welcart-e-commerce/
RedPacket Security
CVE Alert: CVE-2026-87091 - uscnanbu - Welcart e-Commerce - RedPacket Security
The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Settlement Notification Parameters in all versions up to, and
CVE Alert: CVE-2026-101928 - magicplugins - Magic Tooltips For Contact Form 7 - https://www.redpacketsecurity.com/cve-alert-cve-2026-101928-magicplugins-magic-tooltips-for-contact-form-7/
RedPacket Security
CVE Alert: CVE-2026-101928 - magicplugins - Magic Tooltips For Contact Form 7 - RedPacket Security
The Magic Tooltips For Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in all versions up to, and
CVE Alert: CVE-2026-101923 - villatheme - Photo Reviews for WooCommerce - https://www.redpacketsecurity.com/cve-alert-cve-2026-101923-villatheme-photo-reviews-for-woocommerce/
RedPacket Security
CVE Alert: CVE-2026-101923 - villatheme - Photo Reviews for WooCommerce - RedPacket Security
The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Arbitrary Content Deletion in versions up to, and including, 1.2.30. This is due to
CVE Alert: CVE-2026-93430 - gdragon - GD Rating System - https://www.redpacketsecurity.com/cve-alert-cve-2026-93430-gdragon-gd-rating-system/
RedPacket Security
CVE Alert: CVE-2026-93430 - gdragon - GD Rating System - RedPacket Security
The GD Rating System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'title' and 'url' Render Args in gdrts_live_handler AJAX in all
CVE Alert: CVE-2026-96575 - ivijanstefan - Transliterator – Multilingual and Multi-script Text Conversion - https://www.redpacketsecurity.com/cve-alert-cve-2026-96575-ivijanstefan-transliterator-multilingual-and-multi-script-text-conversion/
RedPacket Security
CVE Alert: CVE-2026-96575 - ivijanstefan - Transliterator – Multilingual and Multi-script Text Conversion - RedPacket Security
The Transliterator – Multilingual and Multi-script Text Conversion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via
CVE Alert: CVE-2026-96564 - rainbowgeek - SEOPress – AI SEO Plugin & On-site SEO - https://www.redpacketsecurity.com/cve-alert-cve-2026-96564-rainbowgeek-seopress-ai-seo-plugin-on-site-seo/
RedPacket Security
CVE Alert: CVE-2026-96564 - rainbowgeek - SEOPress – AI SEO Plugin & On-site SEO - RedPacket Security
The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Author Display Name in all versions up
[QILIN] - Ransomware Victim: Genesis Credit Management - https://www.redpacketsecurity.com/qilin-ransomware-victim-genesis-credit-management/
RedPacket Security
[QILIN] - Ransomware Victim: Genesis Credit Management - RedPacket Security
NOTE: No files or stolen information are exfiltrated, downloaded, taken, hosted, seen, reposted, or disclosed by RedPacket Security. Any legal issues relating
[NETRUNNER] - Ransomware Victim: Precon Marine Inc - https://www.redpacketsecurity.com/netrunner-ransomware-victim-precon-marine-inc/
RedPacket Security
[NETRUNNER] - Ransomware Victim: Precon Marine Inc - RedPacket Security
NOTE: No files or stolen information are exfiltrated, downloaded, taken, hosted, seen, reposted, or disclosed by RedPacket Security. Any legal issues relating
[RHYSIDA] - Ransomware Victim: Skaff Group - https://www.redpacketsecurity.com/rhysida-ransomware-victim-skaff-group/
RedPacket Security
[RHYSIDA] - Ransomware Victim: Skaff Group - RedPacket Security
NOTE: No files or stolen information are exfiltrated, downloaded, taken, hosted, seen, reposted, or disclosed by RedPacket Security. Any legal issues relating
HackerOne Bug Bounty Disclosure: path-traversal-in-mbstream-extract-riley-scott-jacob - https://www.redpacketsecurity.com/hackerone-bugbounty-disclosure-path-traversal-in-mbstream-extract-riley-scott-jacob/
RedPacket Security
HackerOne Bug Bounty Disclosure: path-traversal-in-mbstream-extract-riley-scott-jacob - RedPacket Security
CompanyMariaDB
CVE Alert: CVE-2026-105115 - OpenIdentityPlatform - OpenAM - https://www.redpacketsecurity.com/cve-alert-cve-2026-105115-openidentityplatform-openam/
RedPacket Security
CVE Alert: CVE-2026-105115 - OpenIdentityPlatform - OpenAM - RedPacket Security
OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allows remote attackers
CVE Alert: CVE-2026-105123 - vincent-peugnet - wcms - https://www.redpacketsecurity.com/cve-alert-cve-2026-105123-vincent-peugnet-wcms/
RedPacket Security
CVE Alert: CVE-2026-105123 - vincent-peugnet - wcms - RedPacket Security
W (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing
CVE Alert: CVE-2026-105126 - laradashboard - laradashboard - https://www.redpacketsecurity.com/cve-alert-cve-2026-105126-laradashboard-laradashboard/
RedPacket Security
CVE Alert: CVE-2026-105126 - laradashboard - laradashboard - RedPacket Security
LaraDashboard before 1.4.8 contains an improper privilege management vulnerability that allows authenticated Admin users to escalate to Superadmin by editing
Weekly Ransomware Intelligence Report: 27 September 2026 to 4 October 2026 - https://www.redpacketsecurity.com/weekly-ransomware-intelligence-report-2026-09-27-2026-10-04/
RedPacket Security
Weekly Ransomware Intelligence Report: 27 September 2026 to 4 October 2026 - RedPacket Security
Ransomware activity at a glance