{"id":76586,"date":"2025-10-15T01:00:00","date_gmt":"2025-10-15T08:00:00","guid":{"rendered":"https:\/\/dhblog.dream.press\/blog\/?p=76586"},"modified":"2026-08-25T20:55:05","modified_gmt":"2026-08-26T03:55:05","slug":"top-cves","status":"publish","type":"post","link":"https:\/\/www.dreamhost.com\/blog\/top-cves\/","title":{"rendered":"Scary Hosting Tales: 10 Security Risks Still Haunting Sites in 2026"},"content":{"rendered":"\n

TL;DR:<\/strong> The scariest website vulnerabilities of the past year didn\u2019t come from WordPress core. They came from plugins, themes, and unpatched server software like OpenSSH and PHP on Ubuntu. Patchstack\u2019s vulnerability database logged 10,230 plugin vulnerabilities and 1,009 theme vulnerabilities for 2025, against just 2 in WordPress core. Every one of those bugs is still dangerous in 2026 on a site that hasn\u2019t patched.<\/p>\n\n\n\n

Below are 10 notable vulnerabilities disclosed in 2025<\/strong>, including how each one worked and what site owners and developers should take away. The bottom line: consistent updates, careful role management, and attention to security advisories are what keep your hosting stories from turning into horror stories.<\/p>\n\n\n\n

\n\n\n\n

It always starts the same way.<\/p>\n\n\n\n

A late-night ping. A panicked client. A WordPress site that was working fine yesterday, but is now coughing up error logs and redirecting visitors to a sketchy pharmacy domain. In your mind, all you can hear is the screeching violins from a horror soundtrack.<\/p>\n\n\n\n

Most scary hosting tales aren\u2019t caused by the ghosts and monsters of spooky season fame. They come from vulnerabilities left unpatched just a little too long. The real danger lives in the plugins, themes, and server software that power your site<\/strong> \u2014 WordPress core itself recorded just two published vulnerabilities in all of 2025, per Patchstack\u2019s database.<\/p>\n\n\n\n

That\u2019s why we\u2019re here, flashlight in hand, to walk you through 10 vulnerabilities that sent shivers down developers\u2019 spines. These aren\u2019t cautionary tales meant to scare you away from the web. They\u2019re field notes from the front lines: lessons you can use to keep your hosting stories from turning into horror<\/em> stories.<\/p>\n\n\n\n

What do the threats to WordPress plugins and Ubuntu packages look like in 2026?<\/h2>\n\n\n\n

Plugins<\/a> and themes<\/a> accounted for almost all recorded WordPress vulnerabilities in Patchstack\u2019s 2025 statistics. For 2025, Patchstack\u2019s WordPress vulnerability statistics<\/a> list 10,230 plugin vulnerabilities (91% of the year\u2019s total) and 1,009 theme vulnerabilities (9%), and exactly 2 in WordPress core (figures as published on Patchstack\u2019s statistics page, checked August 2026). Only one of those core vulnerabilities had been identified by mid-2025, when the chart below was drawn, per Patchstack\u2019s mid-year report.<\/p>\n\n\n\n

Volume is only half the story. Patchstack\u2019s 2025 mid-year vulnerability report<\/a> counted 6,700 new vulnerabilities across plugins, themes, and core in the first six months of 2025, classified 41% of them as exploitable in real-life attacks, and found that 57.6% could be exploited by a complete outsider with no login or stolen credentials at all.<\/p>\n\n\n\n

The server layer needs the same attention. Canonical publishes Ubuntu Security Notices (USNs)<\/a> continuously for supported releases<\/a>, and many of them cover software your hosting stack depends on. In 2025 alone, those notices included an OpenSSH directive that failed to disable forwarding as documented and a PHP flaw that could crash the interpreter (both covered below).<\/p>\n\n\n\n

\"Bar
Where 2025 WordPress vulnerabilities lived: plugins (10,230), themes (1,009), and WordPress core (2). Source: Patchstack WordPress vulnerability statistics, checked August 2026.<\/figcaption><\/figure>\n\n\n\n

So what should site owners take away from those numbers? Three things:<\/p>\n\n\n\n

    \n
  1. You can\u2019t rely on core for protection \u2013 <\/strong>Nearly all of the recorded 2025 WordPress vulnerabilities were in third-party code. Keeping WordPress itself updated is table stakes, not a security strategy.<\/li>\n\n\n\n
  2. Exploitability is high \u2013 <\/strong>Patchstack classified 41% of the vulnerabilities found in the first half of 2025 as exploitable in real-life attacks, and most required no authentication at all.<\/li>\n\n\n\n
  3. OS vulnerabilities compound the risk \u2013 <\/strong>Even if every plugin is patched, outdated Ubuntu packages widen the attack surface underneath your site.<\/li>\n<\/ol>\n\n\n\n

    The 10 scary tales: what went wrong (and what can we learn from it)?<\/h2>\n\n\n\n

    Below are real WordPress and Ubuntu vulnerabilities disclosed in 2025. They aren\u2019t ancient history: they can still expose sites that run affected versions and meet the relevant exploit conditions.<\/p>\n\n\n\n

    1. Post SMTP<\/h3>\n\n\n\n

    What happened: <\/strong>Versions 3.2.0 and earlier of the Post SMTP plugin contained an authentication bypass<\/a> (CVE-2025-24000). Patchstack scored it 8.8<\/a>, flagged it as high priority, and warned that flaws in this class let a malicious actor perform actions reserved for higher-privileged users \u2014 potentially all the way to admin access. The fix shipped in version 3.3.0.<\/p>\n\n\n\n

    Post SMTP\u2019s WordPress.org listing highlights detailed email logs as a feature. Combined with Patchstack\u2019s high-priority rating and the potential for higher-privileged actions, that makes strict authorization around the plugin essential.<\/p>\n\n\n\n

    Post SMTP is also popular: its WordPress.org listing counts over 400,000 website owners using it. Bugs in widely installed plugins attract attackers fast.<\/p>\n\n\n\n

    Key takeaway: <\/strong>Being logged in is not the same as being authorized. Privilege checks must match the sensitivity of the endpoint they guard.<\/p>\n\n\n

    \n\tRelated Article<\/span>\n\t
    \n\t\t
    \n\t\t\tKeep Your Comms Private: Your Best Secure Email Options in 2026\n\t\t<\/div>\n\t\t\n\t\t\tRead More\n\t\t<\/a>\n\t<\/div>\n<\/div>\n\n\n

    2. Essential Addons for Elementor<\/h3>\n\n\n\n

    What happened: <\/strong>Versions 6.0.14 and earlier of Essential Addons for Elementor had a reflected cross-site scripting (XSS) vulnerability<\/a> (CVE-2025-24752): input wasn\u2019t properly neutralized before being embedded into page output, so a crafted URL could run a script in a visitor\u2019s browser.<\/p>\n\n\n\n

    This plugin serves more than 2 million active users<\/strong>, per its WordPress.org listing, so a flaw like this has enormous potential reach. Reflected XSS can enable phishing, credential theft, or defacement if an attacker tricks a user into clicking a crafted link.<\/p>\n\n\n\n

    Key takeaway: <\/strong>Popular plugin + simple input vector = widespread risk. A large install base magnifies even \u201cjust XSS\u201d vulnerabilities.<\/p>\n\n\n\n

    3. WPForms Lite<\/h3>\n\n\n\n

    What happened: <\/strong>WPForms versions up to and including 1.9.5 were vulnerable to stored cross-site scripting<\/a> via the start_timestamp<\/code><\/strong> parameter (CVE-2025-3794). Authenticated users with Contributor role or above<\/strong> could inject scripts that persist and run whenever anyone views the compromised page.<\/p>\n\n\n\n

    Because Contributor access is often granted (and then forgotten) on sites with multiple authors, the risk was real. Stored XSS doesn\u2019t end when a victim closes the tab: the payload lives in your database until someone finds and removes it, and it can steal cookies or session data from every user who loads the injected page.<\/p>\n\n\n\n

    Key takeaway: <\/strong>Stored XSS via lower-privileged roles is dangerous. Audit who has accounts on your site \u2014 even \u201ctrusted\u201d users widen the attack surface.<\/p>\n\n\n\n

    \n\n\n

    Get Content Delivered Straight to Your Inbox<\/h2>

    Subscribe now to receive all the latest updates, delivered directly to your inbox.<\/p>

    <\/div>