9 vulnerabilities across 9 products scored HIGH or above on October 31, 2026.

  • 🟠 HIGH: 9

🟠 [HIGH] wordpress_foundation/wordpress

1 CVE | CVSS 3.1: 8.1 | AAS 10.2

  • cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* (>= 4.7, < 7.1.4)

WordPress Core — HIGH Severity (CVSS 8.1)

One vulnerability affects WordPress Core versions 4.7 through 7.1.3 involving remote code execution due to predictable, web-accessible staging paths used during full-package core upgrades. An unauthenticated attacker can exploit this during the upgrade window to execute arbitrary code on the server. Given WordPress’s massive install base, this is relevant to virtually every organization running self-hosted WordPress. Administrators should update to WordPress 7.1.4 or later immediately, avoid performing core upgrades on internet-facing instances without additional access controls, and review server logs for any suspicious activity during recent upgrade windows. See the vendor advisory at core.trac.wordpress.org for technical details.

Vendor Advisory

🟠 [HIGH] uncannyowl/uncanny_toolkit_for_learndash

1 CVE | CVSS 3.1: 9.8 | AAS 10.1

  • cpe:2.3:a:uncannyowl:uncanny_toolkit_for_learndash:*:*:*:*:*:*:*:* (< 3.8.3)

Uncanny Toolkit for LearnDash (WordPress Plugin) — HIGH Severity (CVSS 9.8)

One critical vulnerability affects the Uncanny Toolkit for LearnDash plugin for WordPress in versions up to and including 3.8.2, allowing unauthenticated attackers to bypass authentication entirely via a parser-differential flaw in the login handler. The plugin’s email verification gate and the subsequent WordPress sign-on call process the submitted email value differently, enabling an attacker to authenticate as any user, including administrators, without valid credentials. Organizations running LearnDash-based WordPress sites with this plugin should update beyond version 3.8.2 immediately or deactivate the plugin until a patch is applied, and review authentication logs for any signs of unauthorized access.

Vendor Advisory

🟠 [HIGH] addonsorg/pdf_invoice_for_woocommerce_+_drag_and_drop_template_builder

1 CVE | CVSS 3.1: 9.8 | AAS 10.1

  • cpe:2.3:a:addonsorg:pdf_invoice_for_woocommerce_drag_and_drop_template_builder:*:*:*:*:*:*:*:* (< 7.1.2)

PDF Invoice for WooCommerce + Drag and Drop Template Builder (WordPress Plugin) — HIGH Severity (CVSS 9.8)

One critical vulnerability affects all versions of this WooCommerce invoicing plugin up to and including 7.1.1, enabling unauthenticated PHP Object Injection through the customer note checkout field. Unsanitized input placed during checkout flows through the invoice rendering pipeline and ultimately reaches an unvalidated unserialize call, potentially allowing remote code execution depending on available gadget chains. Any WooCommerce store using this plugin should update to version 7.2.0 or later immediately, and operators should review recent orders for suspicious or unusually formatted customer notes that may indicate exploitation attempts.

Vendor Advisory

🟠 [HIGH] apache_software_foundation/apache_mina

1 CVE | CVSS 3.1: 9.8 | AAS 9.9

  • cpe:2.3:a:apache:apache_mina:*:*:*:*:*:*:*:* (>= 3.0.0)

Apache MINA 3.0 — HIGH Severity (CVSS 9.8)

One critical vulnerability in Apache MINA 3.0’s JavaNativeMessageDecoder allows unauthenticated remote code execution via unsafe Java deserialization, as the decoder calls ObjectInputStream.readObject() on incoming frame bytes with no class filtering, exposing any application using it against untrusted peers to gadget-chain attacks. The Apache Software Foundation has designated this as unsupported and will not release a fix for the 3.0.0 branch. Organizations still using Apache MINA 3.0 should migrate to the actively maintained 2.2.x branch immediately, and in the interim ensure that no MINA 3.0 endpoints are exposed to untrusted network traffic.

Vendor Advisory

🟠 [HIGH] popupbuilder/popup_builder_–_create_highly_converting,_mobile_friendly_marketing_popups.

1 CVE | CVSS 3.1: 9.1 | AAS 9.9

  • cpe:2.3:a:popupbuilder:popup_builder_create_highly_converting_mobile_friendly_marketing_popups.:*:*:*:*:*:*:*:* (< 4.4.6)

Popup Builder for WordPress — HIGH Severity (CVSS 9.1)

One vulnerability affects the Popup Builder plugin for WordPress in all versions up to and including 4.4.5, allowing unauthenticated attackers to bypass authorization checks and trash all published popups on a site with a single GET request. The impact is amplified by a secondary flaw in the popup lookup logic that extends the destructive reach of the attack. Given Popup Builder’s widespread use across WordPress sites, administrators should update beyond version 4.4.5 immediately and verify that existing popup content has not been moved to trash unexpectedly.

Vendor Advisory

🟠 [HIGH] apache_software_foundation/apache_thrift

1 CVE | CVSS 4.0: 8.2 | AAS 9.7

  • cpe:2.3:a:apache:apache_thrift:*:*:*:*:*:*:*:* (< 0.24.0)

Apache Thrift Java Bindings — HIGH Severity (CVSS 8.2)

One vulnerability affects all versions of Apache Thrift prior to 0.24.0, where uncontrolled recursion in the Java bindings can be triggered by crafted input, potentially leading to denial of service through stack exhaustion. Any application using Apache Thrift’s Java library to process untrusted messages is at risk. Organizations should upgrade to Apache Thrift version 0.24.0 or later, which resolves the issue, and consider implementing input depth limits on Thrift-processing services in the interim.

Vendor Advisory

🟠 [HIGH] murgroland/wp_booking_system_–_booking_calendar

1 CVE | CVSS 3.1: 9.1 | AAS 9.4

  • cpe:2.3:a:murgroland:wp_booking_system_booking_calendar:*:*:*:*:*:*:*:* (< 2.1.0.6)

WP Booking System — Booking Calendar (WordPress Plugin) — HIGH Severity (CVSS 9.1)

One vulnerability affects the WP Booking System plugin for WordPress in versions up to and including 2.1.0.5, where a missing capability check on the calendar note removal function allows any authenticated user with Subscriber-level access or above to delete arbitrary calendar notes across all calendars. This could enable low-privileged attackers to silently wipe booking notes and disrupt scheduling operations site-wide. Administrators running this plugin should update beyond version 2.1.0.5 immediately and audit calendar note histories for any unexplained deletions.

Vendor Advisory

🟠 [HIGH] redhat/konflux-ci

1 CVE | CVSS 3.1: 8.8 | AAS 9.2

  • cpe:2.3:a:redhat:konflux-ci:*:*:*:*:*:*:*:*

Red Hat Konflux-CI — HIGH Severity (CVSS 8.8)

One vulnerability in Konflux-CI allows an attacker with permission to trigger automated workflow runs to inject malicious filter commands through crafted issue titles, which the workflow scripts incorporate into data queries without proper sanitization. Successful exploitation can expose sensitive information including API credentials, deployment keys, and internal notes from repository queries. Organizations using Konflux-CI should consult the Red Hat advisory for available patches, restrict workflow trigger permissions to trusted users, and rotate any credentials that may have been accessible through affected pipelines.

Vendor Advisory

🟠 [HIGH] smub/photo_gallery,_sliders,proofing_and_themes–_nextgen_gallery

1 CVE | CVSS 3.1: 8.8 | AAS 9.1

  • cpe:2.3:a:smub:photo_gallery_sliders_proofing_and_themes_nextgen_gallery:*:*:*:*:*:*:*:* (< 4.4.2)

NextGEN Gallery for WordPress — HIGH Severity (CVSS 8.8)

One vulnerability affects the NextGEN Gallery plugin in all versions up to and including 4.4.1, enabling remote code execution through a chain of flaws involving unrestricted mass assignment of metadata keys, missing path containment in file operations, and a bypassable signature check on the public image delivery route. Authenticated attackers with even minimal custom-level access can exploit this to execute arbitrary code on the server. Given NextGEN Gallery’s widespread adoption as one of the most popular WordPress gallery plugins, administrators should update beyond version 4.4.1 immediately and review server logs for any unusual image delivery requests or unexpected file modifications.

Vendor Advisory