Security Digest: June 24, 2026 - 23 Critical Vulnerabilities

Today’s security picture is dominated by multiple unauthenticated takeover paths, remote command execution risks, and exposed WordPress attack surfaces. The most urgent issue is the GeoVision GV-I/O Box 4E flaws, where network-reachable services can be abused for stack overflow and command injection; several WordPress plugins also allow account takeover, SQL injection, SSRF, and stored XSS with little or no authentication.

· 14 min read

Executive Summary

Today’s security picture is dominated by multiple unauthenticated takeover paths, remote command execution risks, and exposed WordPress attack surfaces. The most urgent issue is the GeoVision GV-I/O Box 4E flaws, where network-reachable services can be abused for stack overflow and command injection; several WordPress plugins also allow account takeover, SQL injection, SSRF, and stored XSS with little or no authentication.

Act now: isolate exposed devices, disable or firewall vulnerable services, and patch every affected plugin or firmware release immediately. If you cannot patch today, remove public access and assume exposed instances are at risk.

Critical Vulnerabilities

  • CVE-2026-12846: GV-I/O Box 4E DVRSearch netmask stack overflow
    • Impact: Remote attacker on the network can trigger memory corruption and potentially execute code.
    • Affected Systems: GeoVision GV-I/O Box 4E, DVRSearch service on UDP/10001.
    • Immediate Action: Block UDP 10001 at the network edge and remove the device from untrusted networks.
    • Mitigation: Apply vendor firmware fixes as soon as available; otherwise segment the device and restrict access to trusted hosts only.
  • CVE-2026-12847: GV-I/O Box 4E DVRSearch gateway stack overflow
    • Impact: Network attacker can crash the service or gain code execution.
    • Affected Systems: GeoVision GV-I/O Box 4E, DVRSearch on UDP/10001.
    • Immediate Action: Disable external access to DVRSearch immediately.
    • Mitigation: Patch firmware; if patching is delayed, isolate the device and monitor for abnormal UDP traffic.
  • CVE-2026-12485: GV-I/O Box 4E DVRSearch IP stack overflow
    • Impact: Attacker-controlled overflow may lead to device compromise.
    • Affected Systems: GeoVision GV-I/O Box 4E, DVRSearch on UDP/10001.
    • Immediate Action: Block the service and inventory all deployed units.
    • Mitigation: Update to a patched release; keep the device on a segregated management VLAN.
  • CVE-2026-12848: GV-I/O Box 4E DVRSearch DNS stack overflow
    • Impact: Remote memory corruption from a crafted network packet.
    • Affected Systems: GeoVision GV-I/O Box 4E, DVRSearch on UDP/10001.
    • Immediate Action: Treat any exposed unit as high risk and restrict inbound UDP traffic now.
    • Mitigation: Apply vendor remediation and verify exposure is closed.
  • CVE-2026-12416: Invoice Generator plugin password reset account takeover
    • Impact: Unauthenticated attackers can reset passwords and take over any WordPress account, including admins.
    • Affected Systems: Invoice Generator plugin for WordPress up to 1.0.0.
    • Immediate Action: Disable the plugin and reset all administrator credentials if the site was exposed.
    • Mitigation: Upgrade to a fixed version; review admin logins and recent password resets.
  • CVE-2026-12417: SignUp & SignIn plugin authentication bypass
    • Impact: Attackers can change user passwords and fully take over WordPress accounts.
    • Affected Systems: SignUp & SignIn plugin up to 1.0.0.
    • Immediate Action: Remove or disable the plugin and force password resets for privileged users.
    • Mitigation: Patch immediately; check admin accounts for unexpected password changes.
  • CVE-2026-12486: GV-I/O Box 4E IP command injection
    • Impact: Crafted network input can lead to remote command execution on the device.
    • Affected Systems: GeoVision GV-I/O Box 4E 2.09, libNetSetObj.so via DVRSearch and Network.cgi.
    • Immediate Action: Block access to management interfaces and the DVRSearch service.
    • Mitigation: Apply the vendor fix; do not expose the device directly to the internet.
  • CVE-2026-12849: GV-I/O Box 4E netmask command injection
    • Impact: Remote attacker can execute operating system commands.
    • Affected Systems: GeoVision GV-I/O Box 4E 2.09, network configuration routines.
    • Immediate Action: Restrict all network configuration endpoints immediately.
    • Mitigation: Patch firmware and validate that only trusted admins can reach configuration services.
  • CVE-2026-12850: GV-I/O Box 4E gateway command injection
    • Impact: Remote code execution via malicious gateway values.
    • Affected Systems: GeoVision GV-I/O Box 4E 2.09, libNetSetObj.so.
    • Immediate Action: Remove external reachability to Network.cgi and DVRSearch.
    • Mitigation: Apply updated firmware and segment device management traffic.
  • CVE-2026-12851: GV-I/O Box 4E DNS command injection
    • Impact: Attacker can run commands through DNS field input.
    • Affected Systems: GeoVision GV-I/O Box 4E 2.09, libNetSetObj.so.
    • Immediate Action: Isolate affected devices and inspect for unauthorized configuration changes.
    • Mitigation: Patch as soon as the vendor release is available.
  • CVE-2026-54639: Style Dictionary prototype pollution
    • Impact: Malicious token data can corrupt object behavior and, in server integrations, lead to broader compromise.
    • Affected Systems: Style Dictionary 4.3.0 through 5.4.3.
    • Immediate Action: Upgrade to 5.4.4 immediately.
    • Mitigation: Sanitize token data and reject keys containing __proto__.
  • CVE-2026-4297: Welcome Software Publishing XML-RPC privilege escalation
    • Impact: Authenticated low-privilege users can change site options and escalate to admin.
    • Affected Systems: Welcome Software Publishing plugin up to 0.0.31.
    • Immediate Action: Disable XML-RPC if unused and patch the plugin.
    • Mitigation: Review default_role and other critical options for tampering.
  • CVE-2026-7761: Ultimate Member password reset link disclosure
    • Impact: Attackers with contributor access can leak live reset links for users, including administrators.
    • Affected Systems: Ultimate Member up to 2.11.4.
    • Immediate Action: Update immediately and invalidate any exposed reset links.
    • Mitigation: Audit member-directory posts and XML-RPC activity.
  • CVE-2026-56052: FunnelKit Funnel Builder blind SQL injection
    • Impact: Attackers can extract database data through crafted requests.
    • Affected Systems: FunnelKit Funnel Builder through 3.15.0.5.
    • Immediate Action: Patch and review database access logs.
    • Mitigation: Limit plugin exposure and rotate credentials if compromise is suspected.
  • CVE-2026-9179: WP Forms Connector SQL injection via order parameter
    • Impact: Unauthenticated attackers may extract or manipulate database data.
    • Affected Systems: WP Forms Connector up to 1.8.
    • Immediate Action: Block the REST endpoint and update the plugin.
    • Mitigation: Treat any exposed instance as compromised until patched.
  • CVE-2026-8705: ClearSale Total SQL injection
    • Impact: Unauthenticated SQL injection may expose or alter data; may also cause denial of service.
    • Affected Systems: ClearSale Total up to 3.4.2 on PHP < 8.0.
    • Immediate Action: Upgrade PHP and the plugin, or disable the vulnerable AJAX action.
    • Mitigation: Verify the nonce handling is fixed before re-enabling.
  • CVE-2026-9178: WP Forms Connector user data exposure
    • Impact: Attackers can retrieve password hashes and email addresses for registered users.
    • Affected Systems: WP Forms Connector up to 1.8.
    • Immediate Action: Restrict the REST route and patch immediately.
    • Mitigation: Rotate credentials if hashes may have been exposed.
  • CVE-2026-10092: Cincopa stored XSS via comments
    • Impact: Malicious scripts can run in visitors’ browsers on infected pages.
    • Affected Systems: Cincopa video and media plug-in up to 1.163.
    • Immediate Action: Update the plugin and review recent comments.
    • Mitigation: Clear malicious content from pages and purge caches.
  • CVE-2026-12100: URL Preview SSRF
    • Impact: Attackers can make the server request internal or sensitive URLs.
    • Affected Systems: URL Preview plugin up to 1.0.
    • Immediate Action: Disable the feature or block outbound access to internal networks.
    • Mitigation: Patch and enforce egress controls.
  • CVE-2026-12095: Kargo Takip SSRF with response leakage
    • Impact: Attackers can query internal services and read returned data, including auth values.
    • Affected Systems: Kargo Takip plugin up to 1.2.
    • Immediate Action: Patch and block access to internal metadata endpoints.
    • Mitigation: Add outbound filtering and monitor for unusual internal requests.
  • CVE-2026-10091: Email JavaScript Cloak stored XSS
    • Impact: Authenticated attackers can inject scripts into pages viewed by others.
    • Affected Systems: Email JavaScript Cloak up to 1.03.
    • Immediate Action: Update the plugin and review contributor content.
    • Mitigation: Remove malicious shortcode usage and clear cached pages.
  • CVE-2026-3652: ARForms stored XSS in partial form entries
    • Impact: Unauthenticated attackers can plant scripts executed by administrators.
    • Affected Systems: ARForms up to 7.1.3.
    • Immediate Action: Patch immediately and inspect partial form data.
    • Mitigation: Sanitize stored entries and review admin sessions.
  • CVE-2026-9643: WP Meta SEO unauthenticated stored XSS
    • Impact: Attackers can store scripts that execute in the admin 404/redirects page.
    • Affected Systems: WP Meta SEO up to 4.5.18.
    • Immediate Action: Update the plugin and review the broken links table.
    • Mitigation: Purge malicious rows and monitor admin actions.

What to Do Now

  1. Patch or disable immediately the GeoVision GV-I/O Box 4E services and all affected WordPress plugins listed above.
  2. Block exposure by restricting UDP/10001, admin panels, XML-RPC, and vulnerable REST/AJAX endpoints to trusted networks only.
  3. Assume compromise for any internet-facing system that could have been reached before patching.
  4. Reset credentials for WordPress administrators and any accounts tied to exposed plugins.
  5. Verify versions against your inventory and confirm upgrades actually applied.
  6. Review logs for suspicious POSTs to admin-ajax.php, unusual REST calls, outbound SSRF traffic, and unexpected device configuration changes.

Verification steps: confirm firmware version on every GV-I/O Box 4E, enumerate WordPress plugin versions, and test whether public access to management interfaces is still possible. Hunt for new admin users, changed options, modified DNS/gateway settings, and unknown outbound requests.

Monitoring recommendations: alert on UDP/10001 traffic, repeated AJAX calls from anonymous users, SQL error spikes, odd DNS or metadata lookups, and any changes to WordPress roles or site options.

Related Resources

  • Internal: A follow-up blog post will be published with exposure checks and emergency response guidance.
  • Official advisories: Monitor vendor security advisories for GeoVision, WordPress plugin maintainers, and Style Dictionary for patches and release notes.

Keep reading