Loading story…
Invoice Ninja versions up to 5.11.72 are affected by an authenticated remote code execution vulnerability in the admin 'Restore' function. Attackers with admin credentials can upload malicious .php files, leading to arbitrary code execution on the server. The issue is resolved in version 5.11.73.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
High-severity CVE entries were published for several WordPress components: WorkScout-Core Plugin before 1.7.06, Custom Post Type Images Plugin 0.5 and earlier, Constructo Theme 4.3.9 and earlier, Findgo Theme 1.3.55 and earlier, and CouponXxL Theme 4.5.0 and earlier. All were described as cross-site request forgery vulnerabilities.
A high-severity vulnerability entry was published for CVE-2025-10009, described as an authenticated admin remote code execution issue in Invoice Ninja.
A pull request was published to the ProjectDiscovery nuclei-templates repository adding detection coverage for CVE-2020-36731, marked as vKEV.
7 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical stored cross-site scripting flaw, tracked as **`CVE-2026-65048`**, was disclosed in the **Ninja Forms** WordPress plugin. The vulnerability affects versions **`3.10.4` through `3.14.9`** and stems from the plugin's **Repeatable Fieldset** feature, where submission indexes are accepted without numeric validation and later rendered into HTML without proper escaping. Because the vulnerable input can be submitted through a public form, the issue can be exploited by an unauthenticated attacker. A successful attack stores malicious JavaScript in form submissions and triggers execution when an administrator reviews those submissions in the WordPress admin panel. The flaw carries a **CVSS 3.1 score of 9.3** and could enable session-cookie theft, administrator account creation, malicious plugin installation, and unauthorized modification of site content. Site owners using Ninja Forms are advised to upgrade to **`3.15.0`** or later to remediate the issue.
Sep 4, 2026
A critical remote code execution vulnerability, tracked as CVE-2026-21877, has been identified in the n8n workflow automation platform. The flaw, rated CVSS 10.0, allows authenticated users to execute arbitrary code on affected n8n instances, posing a significant risk to environments where n8n is used to automate workflows with access to sensitive data, internal systems, and credentials. The vulnerability impacts n8n versions from 0.123.0 up to but not including 1.121.3, affecting both self-hosted and managed deployments. Exploitation requires authenticated access, and the vulnerability is linked to unsafe handling that can result in the execution of untrusted code. The issue has been addressed in n8n version 1.121.3 and later, and users are strongly advised to upgrade immediately to mitigate the risk. Additional recommendations include restricting workflow modification access to trusted administrators, blocking high-risk nodes at runtime, and reviewing audit logs for suspicious activity prior to patching. No public exploit details or proof-of-concept have been released as of the latest advisories. Organizations using n8n should prioritize patching and implement hardening measures to prevent potential compromise of their automation infrastructure.
Jun 29, 2026
Attackers are actively exploiting **CVE-2026-0740**, a critical unauthenticated arbitrary file upload flaw in the **Ninja Forms File Uploads** premium add-on for WordPress that can lead to **remote code execution** and full site compromise. The vulnerability affects versions through `3.3.26` and stems from improper validation of file types and extensions in destination filenames, combined with missing filename sanitization that allows path traversal and placement of malicious PHP files in the webroot or other sensitive directories. Wordfence said it blocked more than **3,600** exploitation attempts in a 24-hour period and warned that attackers could use the bug to deploy web shells and take over vulnerable sites. Researcher **Sélim Lanouar** discovered the issue through Wordfence’s bug bounty program, and the vendor released a full fix in version `3.3.27` after an earlier partial remediation. Organizations using the add-on, which is deployed across more than **90,000** customer environments, have been urged to upgrade immediately.
Jun 29, 2026