Published threat advisories for October 16, 2026

A critical vulnerability exists in the MailOptin WordPress plugin, allowing unauthenticated attackers to take over any user account, including administrators. This could lead to full website compromise by exploiting how the plugin handles user registration data to overwrite passwords. The issue is reachable if a WordPr

NVD modified: NVD date unavailable

The Mang Board WordPress plugin has a vulnerability allowing unauthenticated attackers to upload executable files. This could lead to remote code execution on the affected site, particularly if guest posting is enabled, which is the plugin's default. This makes it possible for unauthorized users to compromise website i

NVD modified: NVD date unavailable

A vulnerability in the My Calendar plugin for WordPress allows unauthenticated attackers to gain administrative access by exploiting how it processes event data. This flaw enables arbitrary code execution, potentially leading to the overwriting of administrator credentials and full site control. The issue is reachable

NVD modified: NVD date unavailable

A critical SQL injection vulnerability exists in Wheels when using MySQL/MariaDB with backslash escaping disabled. Attackers can inject malicious SQL code by manipulating request data within specific query types, potentially leading to unauthorized access or modification of database content. Confirming affected instanc

NVD modified: NVD date unavailable