News & Sicurezza

WordPress Backup Plugin Vulnerability Exposes 800,000 Sites to Remote Code Execution Attacks A critical flaw in the WPvivid Backup & Migration WordPress plugin can let an unauthenticated attacker upload files and run code on the server, a path that often ends in full site takeover. The issue ... Read more Published Date: Feb 12, 2026 (3 days, 7 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-1357

Windows Notepad Markdown feature opens door to RCE (CVE-2026-20841) Among the many security fixes released by Microsoft on February 2026 Patch Tuesday is one for CVE-2026-20841, a command injection vulnerability in Notepad that could be exploited by attackers to achie ... Read more Published Date: Feb 12, 2026 (3 days, 8 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-20841

IOS-lek geeft aanvaller toegang tot foto's op vergrendelde iPhone Een kwetsbaarheid in iOS maakt het mogelijk voor een aanvaller met fysieke toegang tot een vergrendelde iPhone om foto's op het toestel te bekijken. Apple heeft updates uitgebracht om het probleem te ... Read more Published Date: Feb 12, 2026 (2 days, 20 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-20642

The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-Forwarded-For' HTTP header in all versions up to, and including, 4.9.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE ID : CVE-2026-1320 Published : Feb. 12, 2026, 2:16 p.m. | 4 hours, 11 minutes ago Description : The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-Forwarded-For' HTTP header in all versions up to, and including, 4.9.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Severity: 7.2 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Farktor Software E-Commerce Services Inc. E-Commerce Package allows Cross-Site Scripting (XSS).This issue affects E-Commerce Package: through 27112025.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Farktor Software E-Commerce Services Inc. E-Commerce Package allows Blind SQL Injection.This issue affects E-Commerce Package: through 27112025.

CVE ID : CVE-2025-13002 Published : Feb. 12, 2026, 2:16 p.m. | 2 hours, 11 minutes ago Description : Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Farktor Software E-Commerce Services Inc. E-Commerce Package allows Cross-Site Scripting (XSS).This issue affects E-Commerce Package: through 27112025. Severity: 8.2 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2025-10969 Published : Feb. 12, 2026, 2:16 p.m. | 2 hours, 11 minutes ago Description : Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Farktor Software E-Commerce Services Inc. E-Commerce Package allows Blind SQL Injection.This issue affects E-Commerce Package: through 27112025. Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Apple patches decade-old iOS zero-day, possibly exploited by commercial spyware Apple patched a zero-day vulnerability affecting every iOS version since 1.0, used in what the company calls an "extremely sophisticated attack" against targeted individuals. CVE-2026-20700, discovere ... Read more Published Date: Feb 12, 2026 (2 days, 19 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-20700 CVE-2025-43529 CVE-2025-14174

Chrome Security Update – Patch for Vulnerabilities that Enables Code Execution Attacks Chrome Security Update Patch Vulnerabilities Google has released Chrome 145 to the stable channel for Windows, Mac, and Linux, addressing 11 security vulnerabilities that could enable attackers to exe ... Read more Published Date: Feb 12, 2026 (2 days, 13 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-2323 CVE-2026-2322 CVE-2026-2321 CVE-2026-2320 CVE-2026-2319 CVE-2026-2318 CVE-2026-2317 CVE-2026-2316 CVE-2026-2315 CVE-2026-2314 CVE-2026-2313

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media[].href' parameter in all versions up to, and including, 5.97.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers (if 'Enable for Guests' is enabled) to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.