Monday, May 11, 2026 Archive

Archived Security Snapshot

Critical vulnerabilities, curated daily for security professionals

Archived Security Brief

WordPress plugin vulnerabilities dominate Monday's disclosures, with four separate CVSS 9.8 flaws affecting MStore API, Plugin Download, TheCartPress, and a related OpenCart vulnerability of the same severity. Yesterday's volume was lighter overall, with 5 critical CVEs (down 37% from 8) and 21 high-priority issues (down 68% from 65). Notable critical entries include CVE-2021-47933 in WordPress MStore API, CVE-2021-47940 in WordPress Plugin Download, and CVE-2021-47923 in OpenCart, all rated CVSS 9.8. Three actively exploited vulnerabilities span ConnectWise ScreenConnect (CVE-2024-1708), Microsoft Windows (CVE-2026-32202), and the Linux Kernel (CVE-2026-31431), reflecting attacker interest in remote management tools and core operating system components. Patches are not yet broadly available across yesterday's disclosure set, so defenders should rely on compensating controls and vendor advisories while monitoring for updates.

  • WordPress plugin ecosystem accounts for four of the five CVSS 9.8 critical vulnerabilities disclosed
  • Critical CVEs declined 37% day-over-day (5 vs 8 prior)
  • High-priority CVEs declined 68% day-over-day (21 vs 65 prior)
  • Actively exploited issues span ConnectWise ScreenConnect, Windows, and the Linux Kernel
  • Patch availability sits at 0% for yesterday's disclosure set, requiring mitigations and monitoring
  • OpenCart joins WordPress in the CVSS 9.8 tier, signaling continued e-commerce platform exposure

Immediate action: Prioritize review of WordPress plugin inventories (MStore API, Plugin Download, TheCartPress) and OpenCart installations, alongside ConnectWise ScreenConnect, Windows, and Linux Kernel systems flagged for active exploitation. With no patches currently available for yesterday's disclosed CVEs, apply vendor-recommended mitigations, restrict exposed admin interfaces, and monitor vendor channels for upcoming fixes.

How to read this brief

CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).

Exploitability — how hard the flaw is to attack, read from the CVSS vector:

  • Network / Adjacent / Local / Physical — how close an attacker must get. Network means reachable over the internet.
  • No / Low / High privileges — the access they need first. No privileges means no login required.
  • No interaction / User interaction — whether a victim has to do something (open a file, click a link). No interaction means fully automatable.

The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.

Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.

EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation