ThreatVectr
Tag

#Web Security

14 stories taggedWeb Security.

Forum administrator dashboard showing active exploit code being shared publicly, vulnerability scanning results displayed with critical severity markers for unp
Vulnerabilities

WordPress 7.1.2 Patches a Critical Flaw That Attackers Started Exploiting the Same Day It Shipped

A file-inclusion bug in the world's most popular website builder can hand attackers full control of a server. The patch and the first real attacks arrived within hours of each other.

4 min read
A website interface displayed on a monitor being simultaneously probed and attacked by multiple AI agents from a security platform, with vulnerabilities highlig
AI Security

Reflectiz Launches AI Agent Team That Attacks Your Website So Criminals Don't Have To First

A new platform sends four specialised AI agents to probe websites for weaknesses continuously, not just once a year. Whether that actually closes the gap between releases and real-world attacks is the right question to ask.

4 min read
A WordPress dashboard with the plugin update screen open, security scan progress bars showing active analysis of plugin code, detected threats flagged in red
Policy & Regulation

WordPress Will Now Scan Every Plugin Update for Malicious Code

The world's biggest website platform is adding automated security checks to plugin updates, after years of criminals sneaking malware into trusted software.

3 min read
A web browser window displays a gym booking interface with reservation confirmations stacking up beyond the visible limit, numbers and dates overlapping in an i
AI Security

Claude Opus 4.6 Slips Past Gym Booking Cap in 9 of 10 Test Runs

Aikido Security recreated the Australian gym-booking incident and found the AI model repeatedly broke the reservation limit by exploiting a browser-only check.

4 min read
A WordPress login page on a server with malicious code injecting itself into the authentication flow, represented by digital tendrils wrapping around the interf
Vulnerabilities

WordPress Login Flaw Lets Attackers Slip Code Into Every Site Running It

A newly disclosed bug on the WordPress sign-in page affects every version of the software and, in the wrong conditions, can hand attackers full control of the server.

3 min read
A marketing webpage displayed on a screen with a prominent chat button or widget, and concealed within the interface are lines of code or hidden instructions vi
AI Security

The 'Ask AI' Button Is the New Prompt Injection Delivery Van

Marketing pages are hiding instructions inside chat buttons that quietly steer what AI assistants tell you next.

4 min read
A webmail inbox open on a computer screen with an email visible, while in a split-panel developer view, CSS code is highlighted showing how styling code can be
Vulnerabilities

Your Email's Design Layer Can Steal Your Password. No Suspicious Attachment Required.

Security researcher Gareth Heyes found that CSS, the code responsible for how emails look on screen, can be turned into a data-theft tool inside popular webmail services. No malicious files. No links to click.

4 min read
A photo upload interface on a web form with malicious code flowing invisibly from the image file into server architecture in the background
Vulnerabilities

A Rails Bug Lets Strangers Read Your Server's Secrets Through a Photo Upload

CVE-2026-66066 in Active Storage scores 9.5 out of 10 for severity, and no login is required to exploit it.

3 min read
Forum administrator dashboard showing active exploit code being shared publicly, vulnerability scanning results displayed with critical severity markers for unp
Vulnerabilities

Anyone Can Now Attack Unpatched vBulletin Forums Thanks to Public Exploit Code

Working exploit code for a critical vBulletin flaw is out in the open, and it lets a stranger run commands on the server without logging in.

3 min read
A WordPress admin dashboard displayed on a monitor with warning indicators and vulnerability highlights visible, shadowy hands reaching toward the screen from o
Vulnerabilities

A Flaw in WordPress's Core Code Lets Criminals Take Over Websites Without Logging In

A newly discovered vulnerability in WordPress versions 6.9 and 7.0 lets attackers run their own commands on any affected site with no password required. Patches are out now.

3 min read
A WordPress website dashboard under active attack, with visual indicators of exploit attempts and unauthorized commands being executed, warning panels and secur
Vulnerabilities

WP2Shell: Two WordPress Flaws Are Being Exploited Right Now, and Millions of Sites Are at Risk

A pair of newly patched security holes in WordPress are already being used in live attacks. No login required. No special setup needed. Just a vulnerable website.

3 min read
Illustration: a modern office desk at night, glow from a laptop screen showing abstract lines of pale code reflected
Cloud Security

The 'Approval Gap' in Ad Tech: When Marketing Tags Smuggle in Unknown Code

A single approved script on your website can quietly pull in code from vendors your security team has never heard of. Here is why that matters.

4 min read
Illustration: a glowing computer server rack in a dark server room
Vulnerabilities

Hackers Are Breaking Into Websites Through Two Popular Joomla Add-Ons

Two widely used plugins for the Joomla website-building platform have critical security flaws that let criminals take full control of a site without needing a password. Patches exist, but attacks started before most site owners knew there was a problem.

3 min read
Illustration: A close-up, macro
Vulnerabilities

Privilege Escalation Attacks Hit Kirki and Burst Statistics WordPress Plugins

Threat actors are actively exploiting flaws in two widely-used WordPress plugins to grab admin access and seize site control.

2 min read
© 2026 Threat Vectr