Critical Vulnerabilities in WordPress Plugin Affecting 10,000 Sites

Rswebsols

Critical Vulnerabilities in WordPress Plugin Affecting 10,000 Sites

First seen 2 Nov 2025, 20:45 UTC • •29.6

Article Content

1 / 3

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

The King Addons plugin for WordPress has been found to contain two critical vulnerabilities that could allow attackers to take over affected sites. These issues enable unauthorized file uploads, potentially impacting up to 10,000 WordPress installations. Additionally, another report indicates that similar vulnerabilities could expose approximately 7 million sites to cross-site scripting (XSS) attacks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 213d ago How this analysis works

More articles in this cluster (2)

Threat Graph

2 entities, 1 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Affected Platform (1)

WordPress

Vulnerability (1)

XSS

Relationships

XSS targets WordPress

Continue Reading

Critical XSS Vulnerability in SUSE Rancher Exposes Admin Sessions A critical vulnerability (CVE-2026-88804) in SUSE Rancher allows unauthenticated remote attackers to execute stored cross-site scripting (XSS) attacks via public UI settings. This affects Rancher versions 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before 2.12.14, and 2.11 before 2.11.18.…

Multiple WordPress Plugins Face Vulnerabilities Requiring Immediate Updates Three WordPress plugins have been reported with vulnerabilities: the GiveWP plugin (version 4.16.9) has a Cross Site Scripting (XSS) vulnerability, while both the Siteskite (version 2.1.8) and Cartflows (version 3.2.0) plugins have Remote Code Execution (RCE) vulnerabilities. The XSS vulnerability allows attackers to…