WordPress core CVE-2026-119977 added to CISA KEV, plus Next.js and Amplify fixes

WordPress core: CVE-2026-119977 (upgrade-window staged-installer RCE)

• What: A time-of-check time-of-use race in full-package core upgrades. Predictable, web-accessible staging paths let an unauthenticated attacker run code on the server during the upgrade window. Affects WordPress 4.7 through 7.1.3. See NVD and the Wordfence advisory.
• Severity: High, CVSS 3.1 8.1 (Wordfence, AV:N/AC:H/PR:N).
• Exploited: Yes. Added to the CISA KEV catalog on 2026-11-03 with a federal due date of 2026-11-06 and forensic triage required.
• Fixed in: WordPress 7.1.4 and the matching security releases on older supported branches.
• What to do: Update to 7.1.4 (or your branch's fixed release), block public web access to wp-content/upgrade/, and review web logs for requests to staged installer paths such as setup-config.php under that folder.

Next.js: moderate security fixes in 16.4.5 and 15.5.29

• What: The v16.4.5 release fixes seven moderate advisories, including CVE-2026-119348 (cross-client response injection when self-hosted apps forward fetched responses behind an HTTP/1.1 proxy), CVE-2026-119349 (cross-user cache disclosure with use cache and binary arguments) and CVE-2026-119350 (fallback shell cache poisoning with Cache Components), plus an SVG image-optimization bypass and an Edge runtime HttpOnly cookie exposure.
• Severity: Moderate, CVSS 4.0 6.3 for each of the three CVEs above.
• Exploited: No exploitation reported; not on CISA KEV.
• Fixed in: 16.4.5; the 15.x line gets the response-injection, SVG and Edge cookie fixes in 15.5.29.
• What to do: Upgrade next. For CVE-2026-119350 the advisory's workaround is setting partialPrefetching: true in next.config.

AWS Amplify maplibre-gl-js-amplify: CVE-2026-121652 (stored XSS)

• What: Stored XSS in popup and geofence-control rendering in versions up to 4.0.2. See AWS bulletin 2026-167-AWS.
• Severity: Not scored by AWS in the bulletin.
• Exploited: No exploitation reported; not on CISA KEV.
• Fixed in: maplibre-gl-js-amplify 4.0.3.
• What to do: Upgrade to 4.0.3 or later; until then, sanitize location and geofence data and apply a restrictive Content Security Policy.