# IT Daily Roundup: October 7, 2026

> Oct 7, 2026 · #security #wordpress #atlassian #libreoffice

Ninja Forms plugin actively exploited on 500,000 sites, Atlassian patched CVE-2026-21589 (CVSS 9.3) across eight products, and LibreOffice fixed a silent RCE in Calc.

## 1. Ninja Forms: Actively Exploited XSS Flaw Puts 500,000 WordPress Sites at Risk

Patchstack researchers identified active attacks on October 4 and 5, exploiting two XSS vulnerabilities in the Ninja Forms plugin (CVE-2026-93836 and CVE-2026-94504). The plugin is installed on more than 500,000 sites. An authenticated attacker can inject malicious JavaScript through either flaw to install backdoor plugins, create hidden administrator accounts, or deploy a file manager accessible without a password. All three attack paths maintain persistent access even after a password change. The fix is version 3.15.4, released October 6, 2026.

> **Why this matters:** Ninja Forms is among the most widely used plugins for contact forms, quote requests, and newsletter signups. If your company site uses it, update to 3.15.4 today. Also check the status of your other plugins: these campaigns run in waves, and the same domain imgcdn1[.]com showed up targeting multiple sites at once.

## 2. Atlassian Patches CVE-2026-21589 in Jira, Confluence and Six Other Tools

Atlassian released patches on October 5 for critical vulnerability CVE-2026-21589 (CVSS 9.3) across eight Data Center products: Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible, and Fisheye. The flaw is a path traversal: an unauthenticated attacker can read any file from the server's webroot directory if they know the exact path. Cloud versions are already patched automatically. Self-hosted installations need to update, for example Jira Software to 9.12.40, 10.3.26, or 11.3.12, and Confluence to 9.2.26 or 10.2.19.

> **Why this matters:** Reading configuration files can expose database passwords, API keys, or other sensitive data stored on the server. No active exploitation has been confirmed yet, but a similar flaw from 2021 (CVE-2021-26086) ended up in CISA's known exploited vulnerabilities catalog within weeks of disclosure. Check with your IT team which version your installation is running.

## 3. LibreOffice Fixed a Silent RCE in Calc, OpenOffice Still Waiting for a Patch

LibreOffice Calc carried vulnerability CVE-2026-63277, shared by Apache OpenOffice as CVE-2026-59265. OpenOffice has not yet released a fix. The attack does not require enabling macros and shows no warning. A spreadsheet with a "database range" pointing to an external server automatically downloads a malicious JAR file and executes it when the file is opened. Java support must be enabled in the application settings for the attack to work. LibreOffice released a fix on October 5 in versions 26.2.5 and 26.8.0.

> **Why this matters:** The standard advice to disable macros from unknown sources does not apply here. This attack bypasses that entirely. For organizations where staff use LibreOffice or OpenOffice: update LibreOffice to 26.2.5 or 26.8.0. Anyone on OpenOffice should either switch temporarily to LibreOffice, or disable Java in settings (Tools > Options > LibreOffice > Advanced, uncheck "Use a Java runtime environment"). Until then, do not open spreadsheet attachments from unknown senders.

---

© 2026 ITself s.r.o. · Standard page: https://itself.sk/blog-en/2026-10-07-it-daily-roundup.html