TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

Sucuri Blog

Vulnerability & Patch Roundup — April 2026

Sucuri Malware Research Team · 5 days ago · Read original ↗

ATT&CK techniques detected

41 predictions
T1190Exploit Public-Facing Application
97%
“redirection security risk : medium exploitation level : no authentication required. vulnerability : open redirection cve : cve - 2026 - 6203 number of installations : 60, 000 + affected software : user registration & membership < = 5. 1. 4 patched versions : user registration & m…”
T1190Exploit Public-Facing Application
96%
“: update to elementor website builder version 3. 35. 6 or greater. advanced custom fields ( acf® ) – broken access control security risk : medium exploitation level : no authentication required. vulnerability : broken access control cve : cve - 2026 - 4812 number of installations…”
T1190Exploit Public-Facing Application
96%
“##pdatatables – cross site scripting ( xss ) security risk : medium exploitation level : no authentication required. vulnerability : cross site scripting ( xss ) cve : cve - 2026 - 5721 number of installations : 70, 000 + affected software : wpdatatables < = 6. 5. 0. 4 patched ve…”
T1190Exploit Public-Facing Application
94%
“or greater. download monitor – arbitrary file download security risk : medium exploitation level : requires author or higher level authentication. vulnerability : arbitrary file download cve : cve - 2026 - 39489 number of installations : 90, 000 + affected software : download mon…”
T1190Exploit Public-Facing Application
94%
“security risk : high exploitation level : requires administrator or higher level authentication. vulnerability : cross site scripting ( xss ) cve : cve - 2025 - 15611 number of installations : 50, 000 + affected software : popup box < = 5. 4. 9 patched versions : popup box 5. 5. …”
T1190Exploit Public-Facing Application
94%
“online course solution 3. 9. 8 mitigation steps : update to tutor lms – elearning and online course solution version 3. 9. 8 or greater. profilepress – content injection security risk : medium exploitation level : no authentication required. vulnerability : content injection cve …”
T1190Exploit Public-Facing Application
93%
“for woocommerce 5. 104. 0 mitigation steps : update to customer reviews for woocommerce version 5. 104. 0 or greater. jupiter x core – cross site scripting ( xss ) security risk : medium exploitation level : requires subscriber or higher level authentication. vulnerability : cros…”
T1190Exploit Public-Facing Application
92%
“ultimate member < = 2. 11. 1 patched versions : ultimate member 2. 11. 2 mitigation steps : update to ultimate member version 2. 11. 2 or greater. jetbackup – path traversal security risk : medium exploitation level : requires administrator or higher level authentication. vulnera…”
T1190Exploit Public-Facing Application
91%
“cve - 2026 - 39467 number of installations : 500, 000 + affected software : metaslider < = 3. 106. 9 patched versions : metaslider 3. 107. 0 mitigation steps : update to metaslider version 3. 107. 0 or greater. slider, gallery, and carousel by metaslider – remote code execution (…”
T1190Exploit Public-Facing Application
91%
“php object injection cve : cve - 2026 - 39474 number of installations : 200, 000 + affected software : post duplicator < = 3. 0. 10 patched versions : post duplicator 3. 0. 11 mitigation steps : update to post duplicator version 3. 0. 11 or greater. mw wp form – directory travers…”
T1190Exploit Public-Facing Application
90%
“or higher level authentication. vulnerability : insecure direct object references ( idor ) cve : cve - 2026 - 5465 number of installations : 90, 000 + affected software : amelia < = 2. 1 patched versions : amelia 2. 2 mitigation steps : update to amelia version 2. 2 or greater. b…”
T1190Exploit Public-Facing Application
89%
“vulnerability : cross site scripting ( xss ) cve : cve - 2026 - 4059 number of installations : 90, 000 + affected software : shoplentor < = 3. 3. 5 patched versions : shoplentor 3. 3. 6 mitigation steps : update to shoplentor version 3. 3. 6 or greater. hustle – broken access con…”
T1190Exploit Public-Facing Application
88%
“. vulnerability : broken access control cve : cve - 2026 - 34903 number of installations : 500, 000 + affected software : ocean extra < = 2. 5. 3 patched versions : ocean extra 2. 5. 4 mitigation steps : update to ocean extra version 2. 5. 4 or greater. yith woocommerce wishlist …”
T1190Exploit Public-Facing Application
87%
“4. 3. 4 or greater. list category posts – cross site scripting ( xss ) security risk : medium exploitation level : requires author or higher level authentication. vulnerability : cross site scripting ( xss ) cve : cve - 2026 - 3005 number of installations : 80, 000 + affected sof…”
T1190Exploit Public-Facing Application
85%
“##igation steps : update to product filter for woocommerce version 3. 1. 3 or greater. contextual related posts – cross site scripting ( xss ) security risk : medium exploitation level : requires contributor or higher level authentication. vulnerability : cross site scripting ( x…”
T1190Exploit Public-Facing Application
84%
“shortcodes ultimate < = 7. 4. 7 patched versions : shortcodes ultimate 7. 4. 8 mitigation steps : update to shortcodes ultimate version 7. 4. 8 or greater. pagelayer – cross site scripting ( xss ) security risk : medium exploitation level : requires contributor or higher level au…”
T1190Exploit Public-Facing Application
83%
“of installations : 700, 000 + affected software : fluent forms < = 6. 1. 9 patched versions : fluent forms 6. 2. 0 mitigation steps : update to fluent forms version 6. 2. 0 or greater. royal addons for elementor – cross site scripting ( xss ) security risk : medium exploitation l…”
T1190Exploit Public-Facing Application
79%
“##e - 2026 - 4299 number of installations : 100, 000 + affected software : mainwp child reports < = 2. 2 patched versions : mainwp child reports 2. 3 mitigation steps : update to mainwp child reports version 2. 3 or greater. the plus addons for elementor – cross site scripting ( …”
T1190Exploit Public-Facing Application
79%
“level authentication. vulnerability : cross site scripting ( xss ) cve : cve - 2026 - 4655 number of installations : 100, 000 + affected software : element pack < = 8. 4. 9 patched versions : element pack 8. 5. 0 mitigation steps : update to element pack version 8. 5. 0 or greate…”
T1190Exploit Public-Facing Application
78%
“mitigation steps : update to wp maps version 4. 9. 2 or greater. advanced product fields ( product addons ) for woocommerce – php object injection security risk : high exploitation level : requires shop manager or higher level authentication. vulnerability : php object injection …”
T1190Exploit Public-Facing Application
76%
“+ affected software : product filter for woocommerce < = 3. 1. 2 patched versions : product filter for woocommerce 3. 1. 3 mitigation steps : update to product filter for woocommerce version 3. 1. 3 or greater. wp maps – cross site scripting ( xss ) security risk : medium exploit…”
T1190Exploit Public-Facing Application
74%
“installations : 100, 000 + affected software : beaver builder < = 2. 10. 1. 1 patched versions : beaver builder 2. 10. 1. 2 mitigation steps : update to beaver builder version 2. 10. 1. 2 or greater. download manager – broken access control security risk : medium exploitation lev…”
T1190Exploit Public-Facing Application
71%
“##ed versions : kadence blocks 3. 6. 4 mitigation steps : update to kadence blocks version 3. 6. 4 or greater. royal addons for elementor – cross site scripting ( xss ) security risk : medium exploitation level : requires contributor or higher level authentication. vulnerability …”
T1190Exploit Public-Facing Application
69%
“: 50, 000 + affected software : yaymail < = 4. 3. 3 patched versions : yaymail 4. 3. 4 mitigation steps : update to yaymail version 4. 3. 4 or greater. themes vantage – cross site scripting ( xss ) security risk : medium exploitation level : requires contributor or higher level a…”
T1190Exploit Public-Facing Application
69%
“level authentication. vulnerability : arbitrary file upload cve : cve - 2026 - 40746 number of downloads : 80, 108 affected software : restaurant zone < = 0. 7. 8 patched versions : restaurant zone 0. 7. 9 mitigation steps : update to restaurant zone theme version 0. 7. 9 or grea…”
T1190Exploit Public-Facing Application
67%
“vulnerability & patch roundup — april 2026 vulnerability reports and responsible disclosures are essential for website security awareness and education. automated attacks targeting known software vulnerabilities are one of the leading causes of website compromises. to help educat…”
T1190Exploit Public-Facing Application
66%
“##igation steps : update to backupbliss version 2. 1. 0 or greater. email encoder – cross site scripting ( xss ) security risk : medium exploitation level : requires administrator or higher level authentication. vulnerability : cross site scripting ( xss ) cve : cve - 2024 - 7083…”
T1190Exploit Public-Facing Application
66%
“9. 8 mitigation steps : update to tutor lms version 3. 9. 8 or greater. tutor lms – sql injection security risk : high exploitation level : requires administrator or higher level authentication. vulnerability : sql injection cve : cve - 2026 - 6080 number of installations : 100, …”
T1190Exploit Public-Facing Application
65%
“brute - force firewall – php object injection security risk : high exploitation level : requires contributor or higher level authentication. vulnerability : php object injection cve : cve - 2026 - 39478 number of installations : 100, 000 + affected software : anti - malware secur…”
T1190Exploit Public-Facing Application
62%
“7, wpforms, elementor forms < = 1. 4. 9 patched versions : database for contact form 7, wpforms, elementor forms 1. 5. 0 mitigation steps : update to database for contact form 7, wpforms, elementor forms version 1. 5. 0 or greater. media library assistant – cross site scripting (…”
T1190Exploit Public-Facing Application
62%
“mitigation steps : update to coblocks version 3. 1. 17 or greater. shortpixel image optimizer – php object injection security risk : high exploitation level : requires author or higher level authentication. vulnerability : php object injection cve : cve - 2026 - 39471 number of i…”
T1588.006Vulnerabilities
59%
“: 50, 000 + affected software : yaymail < = 4. 3. 3 patched versions : yaymail 4. 3. 4 mitigation steps : update to yaymail version 4. 3. 4 or greater. themes vantage – cross site scripting ( xss ) security risk : medium exploitation level : requires contributor or higher level a…”
T1190Exploit Public-Facing Application
51%
“required. vulnerability : content injection cve : cve - 2026 - 2519 number of installations : 70, 000 + affected software : bookly < = 27. 0 patched versions : bookly 27. 1 mitigation steps : update to bookly version 27. 1 or greater. greenshift – cross site scripting ( xss ) sec…”
T1190Exploit Public-Facing Application
48%
“3. 3. 2 mitigation steps : update to categories images version 3. 3. 2 or greater. better find and replace – cross site scripting ( xss ) security risk : medium exploitation level : requires author or higher level authentication. vulnerability : cross site scripting ( xss ) cve :…”
T1190Exploit Public-Facing Application
45%
“2 patched versions : learnpress 4. 3. 3 mitigation steps : update to learnpress version 4. 3. 3 or greater. onesignal – broken access control security risk : low exploitation level : requires subscriber or higher level authentication. vulnerability : broken access control cve : c…”
T1190Exploit Public-Facing Application
42%
“: sensitive data exposure cve : cve - 2026 - 5234 number of installations : 100, 000 + affected software : latepoint < = 5. 3. 9 patched versions : latepoint 5. 4. 0 mitigation steps : update to latepoint version 5. 4. 0 or greater. modula image gallery – php object injection sec…”
T1190Exploit Public-Facing Application
34%
“to pdf invoices & packing slips for woocommerce version 5. 9. 0 or greater. cmp – coming soon & maintenance plugin – arbitrary file upload security risk : high exploitation level : requires administrator or higher level authentication. vulnerability : arbitrary file upload cve : …”
T1190Exploit Public-Facing Application
34%
“of installations : 400, 000 + affected software : shortcodes ultimate < = 7. 4. 9 patched versions : shortcodes ultimate 7. 5. 0 mitigation steps : update to shortcodes ultimate version 7. 5. 0 or greater. wp shortcodes plugin — shortcodes ultimate – cross site scripting ( xss ) …”
T1190Exploit Public-Facing Application
34%
“download manager version 3. 3. 53 or greater. everest forms – php object injection security risk : critical exploitation level : no authentication required. vulnerability : php object injection cve : cve - 2026 - 3296 number of installations : 100, 000 + affected software : evere…”
T1190Exploit Public-Facing Application
33%
“– broken access control security risk : medium exploitation level : no authentication required. vulnerability : broken access control cve : cve - 2026 - 1314 number of installations : 80, 000 + affected software : 3d flipbook < = 1. 16. 17 patched versions : 3d flipbook 1. 16. 18…”
T1190Exploit Public-Facing Application
33%
“theme version 1. 1. 2 or greater. ecommerce zone – arbitrary file upload security risk : critical exploitation level : requires subscriber or higher level authentication. vulnerability : arbitrary file upload cve : cve - 2026 - 40747 number of downloads : 89, 443 affected softwar…”

Summary

Vulnerability & Patch Roundup — April 2026

Vulnerability reports and responsible disclosures are essential for website security awareness and education. Automated attacks targeting known software vulnerabilities are one of the leading causes of website compromises.

To help educate website owners about potential threats to their environments, we’ve compiled a list of important security updates and vulnerability patches for the WordPress ecosystem this past month.

The vulnerabilities listed below are virtually patched by the Sucuri Firewall and existing clients are protected.

Continue reading Vulnerability & Patch Roundup — April 2026 at Sucuri Blog.