Elementor

BdThemes Supply-Chain XSS Leads to Web Shells

Wordfence Threat Intelligence reported a critical supply-chain compromise in the BdThemes ecosystem where attackers wrote malicious JSON to the vendor's static storage. A DOM XSS (unescaped display_id in the Biggopti JSON) executed inside logged-in WordPress administrator browsers, causing external scripts (w2.js / x.js) to run. The payloads used administrator sessions to create rogue admin accounts, upload a fake plugin, deploy a web shell (emer-run.php), install MU-plugin persistence, and hide created accounts while beaconing results to a C2. Active attacks were observed on August 7, 2026 and the vendor JSON returned to clean on August 8. Affected plugins include Element Pack, Prime Slider, Pixel Gallery, Ultimate Post Kit, Ultimate Store Kit, Live Copy Paste, Smart Admin Assistant.

Don't apply WordPress majors on day one

This guidance argues that WordPress major releases should not be applied to production immediately. It distinguishes majors (feature/API changes) from minor security patches and recommends a five-axis calibration framework: (1) wait for the first patch (x.0.1), which commonly appears 1–3 weeks after a major release; (2) wait until major plugin vendors declare support via the 'Tested up to' field; (3) soak upgrades in staging for at least a week to surface time-delayed issues; (4) roll out in waves according to site risk profile (high/medium/low); and (5) align upgrades with client contracts or SLA windows. The article frames the trade-off between faster access to features and the operational and revenue risks of rushed upgrades.

WP Maintenance Manager Adds Selective Cross‑Site Plugin Updates

A Dev.to post by Susumu Takahashi describes WP Maintenance Manager v1.6.2, which introduces a cross‑site, two‑axis (site × plugin) dashboard that lets operators select specific plugin/site combinations for targeted updates across multiple WordPress installs. The feature runs selective updates using the same safety mechanisms as regular maintenance runs — pre‑update database backups, one‑plugin‑at‑a‑time HTTP checks with automatic pinpoint rollback, visual checks, and summary reporting — while skipping core/theme/translation updates. The dashboard performs an SSH‑parallel scan to surface out‑of‑date plugins (examples: Elementor, Yoast SEO), caches results in the browser, and records audit trails for selective update runs.