WordPress plugin security: ACF, CleanTalk, Optimole and 3 more
Six popular WordPress plugins have holes that need no login, including ACF and CleanTalk. Check your versions and update today.
Plugin and theme security
Holes in popular plugins and themes, and the safe version to update to.
All WordPress
17 posts
Every topic in WordPress.
WordPress core updates
1 post
New WordPress versions and security releases: what changed, whether to update now and what to check on your business website after the update.
Latest: WordPress plans AI assistant access for version 7.3
Plugin and theme security
13 posts
Holes in popular plugins and themes, and the safe version to update to.
Latest: WordPress plugin security: ACF, CleanTalk, Optimole and 3 more
Updating safely
No posts yet
Backup first, update order, testing and rolling back.
Speed and maintenance
2 posts
Website maintenance for WordPress: updates, backups, caching, PHP versions and the monthly checks that keep a business site fast and healthy.
Latest: Website maintenance in Malaysia: do it yourself or outsource?
WordPress plugin security round-up: 31 Oct to 6 Nov 2026
Duplicator, WPvivid, Form Maker, GiveWP, Redux and about 20 more plugins fixed security holes this week. Three have no fix: remove them.
LiteSpeed Cache 7.9.2 fixes a WooCommerce data leak: update
LiteSpeed Cache 7.9.1 and older could expose WooCommerce cart and checkout data to visitors who are not logged in. Update to 7.9.2 or later.
WordPress plugin security: ACF Extended PRO and 15 more
Update ACF Extended PRO now: Patchstack rates it 10 out of 10 and exploited. WooPayments, Easy Digital Downloads and SureCart also have fixes.
WordPress plugin security: s2Member RCE fix and 5 more
s2Member up to 260927 lets anyone run code on the server. Update to 261001 or newer, and check five more plugins fixed this week.
WordPress plugin security: Contact Form 7 6.2.4 and 5 more
Contact Form 7 6.2 to 6.2.3 has a file upload hole open to any visitor. Update to 6.2.4 or newer, and check Ninja Forms, MapPress and three more plugins.
WordPress plugin security: FormFlow, Relevanssi and 11 more
13 WordPress plugins fixed security holes, some open to any visitor. Check FormFlow, WP Directory Kit, Relevanssi and payment plugins first.
WordPress plugin security update: Avada and 30 more to patch
The Avada theme, WP Project Manager, a PDF invoice plugin and about 30 other WordPress add-ons fixed security holes this week. Check your list and update.
WordPress plugin security round-up: 24 to 30 October 2026
Gravity Forms, AI Engine and about 30 other WordPress plugins fixed security holes this week. Check your plugin list and update.
WordPress plugin holes: payment plugins and GoSMTP
Several WooCommerce payment plugins could mark orders as paid without payment. Check this week's plugin list and update today.