WordPress

Pi-hole, the widely-used open-source network-wide ad blocker, has disclosed a data breach affecting nearly 30,000 of its donors. The incident was traced back to a security flaw in the GiveWP WordPress plugin, which Pi-hole utilized to manage donor information.

A critical zero-day vulnerability (CVE-2025-5394) found in the widely used "Alone – Charity Multipurpose Non-profit WordPress Theme" is currently being actively exploited in the wild, putting thousands of WordPress sites at significant risk. This severe security flaw enables unauthenticated attackers to remotely upload arbitrary files and achieve full remote code execution (RCE), often resulting in complete site compromise.

A recently discovered backdoor targeting the WordPress mu-plugins directory is raising significant concerns within the website security community. This sophisticated malware grants attackers persistent and covert access to infected sites, making detection and remediation particularly challenging for administrators.

A series of critical vulnerabilities have been discovered in the popular Forminator WordPress plugin, which is used by hundreds of thousands of websites to create contact forms, payment forms, and other interactive elements. These vulnerabilities have put over 400,000 to 600,000 WordPress websites at risk of remote takeover and other severe attacks.