Attackers hijack Convertr analytics script to skim checkout card data
Sansec says a Brazilian gang altered Convertr’s Plausible tracker; the skimmer was later removed and Plausible upgraded to a patched version.
74
Product
WooCommerce
- Mentions · 7d1
- Mentions · 30d8
- All mentions14
- First seenAug 17, 2026
- Last mentioned3d ago
Timeline
14 articles · newest firstTalos tracks two unauthenticated PHP core RCEs called php2shell
Talos had not seen exploitation as of October 21 and says about half of PHP systems may never be patched.
84
PHP to fix two critical RCEs, CVE-2026-109618 and CVE-2026-109619
The official fix is due October 21 at 14:00 UTC; PHP 8.1 and older will not get one.
82
Wordfence Intelligence Weekly WordPress Vulnerability Report (October 5, 2026 to October 11, 2026)
Wordfence logged 655 WordPress plugin and theme flaws last week, including core XSS and unauthenticated SQL injection.
58
Ninja Forms plugin flaw exploited to hack WordPress sites
Hackers exploit stored XSS in Ninja Forms and a WooCommerce plugin to backdoor WordPress sites and hide admin accounts.
74
Four ways back in: the WordPress XSS campaign that hides its own admin account
Attackers are exploiting stored XSS in two WordPress plugins to install hidden admin backdoors.
76
Milk Dragon AiTM Kit Uses Real-Time OTP Relay and WebSocket Keylogging to Bypass MFA
Group-IB says the Milk Dragon kit relays OTPs live to steal shoppers' card payments across 66 countries.
68
Milk Dragon Phishing Kit Uses Facebook and TikTok Discounts to Steal Cards and Bypass MFA
Milk Dragon uses fake social-media discounts to steal cards and intercept 3-D Secure codes.
67
Automattic has a new board after failed attempt to put CEO on leave
Automattic CEO Matt Mullenweg named a new board after directors failed to sideline him.
6
Stealthy WordPress Malware Uses Must-Use Plugin and Ethereum EtherHiding for Persistent Backdoor Access
Wordfence details a WordPress must-use plugin backdoor that steals credentials and hides C2 on Ethereum.
60
Automattic's board forces CEO Matt Mullenweg into leave of absence
Automattic's board voted to place CEO Matt Mullenweg on paid leave against his will, naming CFO Mark Davies interim CEO of WordPress's parent company.
5
Risky Bulletin: Russia tells data centers to deploy drone defenses
Russia ordered data center operators to deploy drone strike defenses under a Putin decree allowing temporary state takeover of unprotected critical infrastructure.
66
Hackers expose donor data from Russian fundraisers for Ukrainians, political prisoners
Hackers breached the Stripe-WooCommerce integrations of Russian fundraisers Davayte and You Are Not Alone, exposing donor emails and partial card details.
50
[webapps] WooCommerce 1.5.0 - Unauthenticated Arbitrary File Upload
An unauthenticated arbitrary file upload exploit was released for a WooCommerce component version 1.5.0, risking site compromise.
23
Related CVEs
by mentions- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-94504<1%7.2Stored XSS in Ninja Forms 3.15.3 Legacy Submission Editor
- Unauthenticated Stored XSS in WPC Product Bundles for WooCommerce
- CVE-2026-8467<1%9.5Code Injection vulnerability in phenixdigital phoenix_storybook allows unauthenticated remote code execution via unsanitized attribute value interpolation in…
Appears with
- WordPressproduct · 9
- Automatticvendor · 3
- Magentoproduct · 3
- Group-IBorganization · 2
- NaiLongmalware · 2
- Patchstackorganization · 2
- Wordfenceorganization · 2
- You Are Not Alonevictim · 2
- Milk Dragonmalware · 2
- WooCommercevendor · 2
- BytePressmalware · 2
- WP Engineorganization · 2
- Tumblrproduct · 2
- Stripevendor · 2
- Ninja Formsproduct · 2
- Automatticorganization · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.