ViWeb Security Briefings

Short, source-based guidance on website and hosting security issues that matter to business website owners.

Scope and update schedule

Curated website and hosting security guidance drawn from public advisories and vendor records within ViWeb's service scope. Entries are general guidance, not a diagnosis of any particular site, and they do not provide complete or real-time coverage.

ViWeb researches daily at 10:00 Vietnam time. Entries are published when a useful, verified change exists, so daily research does not mean daily publication. Each entry shows the absolute date it was last verified. Check the original advisories before acting.

  1. Attention Exploitation not established

    BuddyForms plugin allows unauthenticated administrator takeover

    Identifiers: CVE-2026-107622

    BuddyForms

    Wordfence disclosed CVE-2026-107622 on 5 November 2026 in the BuddyForms WordPress plugin, affecting versions 2.10.5 and earlier. Version 2.10.6 is patched; the vendor readme dated 19 October 2026 lists matching security fixes.

    Who is affected: Only sites running BuddyForms 2.10.5 or earlier with both WordPress Anyone can register enabled and at least one public BuddyForms form attached to a page. Other WordPress sites are not affected by this issue.

    Last substantive change
    Last verified

    Last verified: . Attention items are due for re-verification within 72 hours.

  2. Attention Exploitation not established

    OpenSSH password bypass on Alpine musl systems without PAM

    Identifiers: OpenSSH-musl-password-bypass-2026-11-05

    OpenSSH on Alpine Linux / musl

    Alpine Linux and OpenSSH published notices on 5 November 2026 about a password authentication bypass on musl-based Linux without PAM. The vendor notice lists no CVE. Fixed Alpine packages and the upstream 10.6p2 workaround are available.

    Who is affected: Alpine openssh-server or openssh-server-pam with UsePAM no and PasswordAuthentication yes, the target account's password field set to * and another account holding a $5$ or $6$ hash, with SSH reachable from the network. Alpine checked 3.16 to 3.24 and edge. Non-Linux, glibc and PAM-authenticated setups and containers without sshd are outside this issue.

    Last substantive change
    Last verified

    Last verified: . Attention items are due for re-verification within 72 hours.

  3. Attention Exploitation not established

    GiveWP 4.19.1 and earlier lets a settings import set Administrator as the default donor role (CVE-2026-118193)

    Identifiers: CVE-2026-118193

    GiveWP

    In GiveWP 4.19.1 and earlier, the normal settings screen blocks Administrator as the default donor role but allows other elevated roles such as Editor. The Tools > Import JSON path bypasses that validation, so an authenticated user with the manage_give_settings capability can set Administrator as the default role for donors who register afterwards.

    Who is affected: WordPress sites running GiveWP 4.19.1 or earlier. The issue requires an authenticated account that holds the manage_give_settings capability, whoever that account belongs to.

    Last substantive change
    Last verified

    Last verified: . Attention items are due for re-verification within 72 hours.

  4. Attention Exploitation not established

    LiteSpeed Cache can store WooCommerce cart and checkout data in public cache (CVE-2026-93389)

    Identifiers: CVE-2026-93389

    LiteSpeed Cache

    In LiteSpeed Cache 7.9.1 and earlier, with the Cache REST option enabled as shipped by default, WooCommerce Store API cart and checkout responses can be cached publicly without varying on Cart-Token or the WooCommerce session. Later unauthenticated visitors may then receive another customer's billing, shipping and cart details, including live cart-session tokens.

    Who is affected: WordPress stores running LiteSpeed Cache 7.9.1 or earlier together with WooCommerce, with the Cache REST option enabled, behind an active public LSCache layer.

    Last substantive change
    Last verified

    Last verified: . Attention items are due for re-verification within 72 hours.

  5. Attention Exploitation not established

    Simple CAPTCHA with Cloudflare Turnstile 1.44.3 and earlier allows stored script through a Gravity Forms shortcode (CVE-2026-93900)

    Identifiers: CVE-2026-93900

    Simple CAPTCHA with Cloudflare Turnstile

    An authenticated user with Contributor or higher access can inject stored script through the id attribute of the [gravity-simple-turnstile] shortcode. The script runs for users who later view content containing it. This is an output-handling issue in the plugin, not a weakness in Cloudflare's Turnstile service and not a CAPTCHA bypass.

    Who is affected: WordPress sites running version 1.44.3 or earlier where Contributor-level or similar accounts can submit content and the Gravity Forms integration shortcode is available. Version 1.44.4, released October 30, addresses this issue; version 1.44.5 adds separate login-form fixes that are not part of this CVE.

    Last substantive change
    Last verified

    Last verified: . Attention items are due for re-verification within 72 hours.