Topic · 6 items
Security
This page gathers the vulnerabilities and updates Preload considered important enough to ask you to act: CMSs, plugins, frameworks, servers. I keep it for anyone maintaining sites in production, with the version to reach and the step that closes the door for each alert.
WordPress 7.2 rebuilds wp_kses() on the HTML API
The filter that sanitizes HTML saved by users without the unfiltered_html capability is being rebuilt on the HTML API, targeting 7.2 or 7.3. The function signature stays the same, but the output changes: lowercase tags, double-quoted attributes, disallowed script elements removed along with their contents, and text such as <$500 escaped instead of stripped. The wp_kses_force_legacy_parser filter restores the old behavior. WordPress 7.2 ships on December 8, with beta 1 on October 20.
Next step
Starting with beta 1, run the tests of your themes and plugins that compare filtered HTML, and look for contributor content that would change when saved.
Next.js: security release on October 14
Vercel is shipping an out-of-band update on Wednesday, October 14, fixing three vulnerabilities in upstream dependencies: two critical and one high. Affected versions will be listed with the advisories. Separately, Next.js 16.4, released on October 6, makes Cache Components the recommended model, and it will become the default in Next.js 17.
Next step
Book an update slot on October 14 for your Next.js apps, then try Cache Components on a branch ahead of version 17.
REA, a reverse engineering MCP server that also reads websites
REA, an MIT-licensed open source tool, gives AI agents the means to analyze binaries, apps and websites. On a website, it attaches read-only to a Chromium browser you already have open and collects the DOM, network activity, JavaScript bundles, routes and source maps. The project is three months old and moving fast (version 6.4.0 on October 11).
Next step
To try it, launch Chromium with a dedicated profile, since the debugging port exposes the whole session, cookies included; stick to your own sites or those of a client who agrees, and keep in mind that the analyzed data goes to your model provider.
WordPress 7.1.3 fixes seven vulnerabilities
The October 6 release fixes seven vulnerabilities, including a stored XSS on the Comments screen, a SQL injection in the WXR export and unauthenticated access to comments on private posts. Several require a contributor account or higher. Fixes are announced for older branches back to 4.7.
Next step
Update to 7.1.3 and clear your page cache, including cached Imgur embeds; on an older branch, make sure your version actually received the fix, and review who holds a contributor role or higher.
Bricksforge under attack, and a campaign that hides its own admin account
The Bricksforge plugin, up to 3.1.8.9, allows unauthenticated file uploads leading to code execution; it has been actively exploited since October 7, and 3.1.8.10 fixes it. Another campaign exploits stored XSS flaws in Ninja Forms (before 3.15.4) and WPC Product Bundles (before 8.6.7): a single execution in an admin session leaves behind an account hidden by a mu-plugin, a secret login URL and a fake file manager plugin. The campaign write-up lists the indicators to look for.
Next step
Update these plugins, then compare the administrators in the database with those shown in the dashboard, inspect wp-content/mu-plugins and regenerate your salts.
Plesk: ten critical fixes in eight weeks
Between August 5 and September 29, the Plesk core received updates flagged “critical security issue” on ten separate dates. From February to July, there had been only three. The fixes include root code execution through the REST API (CVE-2026-68492, fixed in 18.0.80.8 and 18.0.81.1) and through an imported database name in Site Import (CVE-2026-87898, fixed in 1.12.2). On January 1, 2027, license prices go up: €15.99 per month excluding VAT for Web Admin, €28.99 for Web Pro and €62.99 for Web Host.
Next step
Run plesk version to confirm the server is at least on 18.0.80.9 or 18.0.81.2, update Site Import and Plesk Migrator or uninstall them if unused, and turn on automatic build updates. If you manage a fleet, stop waiting for the monthly maintenance window when a fix is flagged critical.
AI speeds up both the discovery and the exploitation of vulnerabilities, and update cycles have to shrink accordingly. We read the price increase as the cost of that pace; Plesk itself does not make that connection.