https://wp-hub.org/ پایش بلادرنگ آسیب‌پذیری‌های CVE، راهنمای افزایش سرعت و بهینه‌سازی، هوش مصنوعی و تحلیل افزونه‌های وردپرس. fa-IR Fri, 09 Oct 2026 18:41:18 +0000 https://wp-hub.org/learn/wp-speed-optimization https://wp-hub.org/learn/wp-speed-optimization سرعت لود یک وب‌سایت وردپرسی فقط یک امتیاز در ابزارهای تست سرعت نیست؛ مستقیماً روی نرخ تبدیل (Conversion Rate)، رتبه سئو در نتایج گوگل و تجربه کاربری کاربران اثر می‌گذارد. در این راهنما، بدون شعار و با روش‌های فنی اثبات‌شده، سایتت را سبک و فوق‌سریع کن. Wed, 26 Aug 2026 16:21:40 +0000 آموزش وردپرس https://wp-hub.org/learn/wp-performance-plugins https://wp-hub.org/learn/wp-performance-plugins انتخاب افزونه کش مناسب برای وردپرس نباید بر اساس حدس و گمان یا تبلیغات باشد؛ بلکه کاملاً به نوع وب‌سرور هاست شما (LiteSpeed، Nginx یا Apache)، میزان پیچیدگی قالب و نوع وب‌سایت (وبلاگی یا ووکامرس) بستگی دارد. در این مقاله ۴ افزونه برتر سرعت وردپرس را با هم مقایسه می‌کنیم. Wed, 26 Aug 2026 16:21:40 +0000 آموزش وردپرس https://wp-hub.org/learn/wp-caching-guide https://wp-hub.org/learn/wp-caching-guide کشینگ (Caching) یعنی ذخیره موقت نتایج محاسبات سنگین برای تحویل فوق‌سریع به درخواست‌های بعدی. در وردپرس بدون سیستم کش، هر بازدیدکننده باعث اجرای صدها کوئری PHP و SQL می‌شود که سرور را زیر بار سنگین خفه می‌کند. در این راهنما با انواع کش و بهترین روش پیکربندی آن آشنا می‌شوید. Wed, 26 Aug 2026 16:21:40 +0000 آموزش وردپرس https://wp-hub.org/learn/what-is-patch https://wp-hub.org/learn/what-is-patch وقتی در اخبار می‌شنویم که یک افزونه وردپرس آسیب‌پذیری داشته و حالا "پچ" شده، دقیقاً یعنی چه؟ آیا با زدن دکمه آپدیت، سایت ما کاملا امن میشه؟ در این مقاله مفهوم وصله امنیتی رو بررسی می‌کنیم و یاد می‌گیریم چطور از رفع شدن واقعی مشکلات مطمئن بشیم. Wed, 26 Aug 2026 16:21:40 +0000 آموزش وردپرس https://wp-hub.org/learn/what-is-cvss https://wp-hub.org/learn/what-is-cvss احتمالا تا حالا دیدی که در اخبار امنیتی می‌نویسن یک آسیب‌پذیری دارای امتیاز ۹.۸ از ۱۰ است! این نمره از کجا میاد و دقیقا چه معنی میده؟ در این مقاله با مفهوم CVSS آشنا میشیم و می‌بینیم چطور می‌تونه به ما در اولویت‌بندی رفع باگ‌های امنیتی کمک کنه. Wed, 26 Aug 2026 16:21:40 +0000 آموزش وردپرس https://wp-hub.org/learn/what-is-cve https://wp-hub.org/learn/what-is-cve وقتی صحبت از امنیت سایت‌ها و سیستم‌های کامپیوتری میشه، همیشه یک اصطلاح خیلی تکرار میشه: CVE. اما CVE چیست و دقیقا چه کاربردی داره؟ در این مقاله می‌خواهیم به‌طور کامل به بررسی مفهوم CVE بپردازیم و ببینیم که چرا برای امنیت وردپرس و هر پلتفرم دیگه‌ای ضروریه. Wed, 26 Aug 2026 16:21:40 +0000 آموزش وردپرس https://wp-hub.org/learn/secure-access https://wp-hub.org/learn/secure-access بخش ورود (Login) سایت شما اولین هدف هکرها و ربات‌های مخرب است. اگر دسترسی مدیران سایت امن نباشد، تمام لایه‌های دیگر امنیتی بی‌معنی خواهند بود. در این مقاله به بررسی راهکارهای عملی برای امن‌سازی صفحه ورود و مدیریت کاربران می‌پردازیم. Wed, 26 Aug 2026 16:21:40 +0000 آموزش وردپرس https://wp-hub.org/learn/safe-update https://wp-hub.org/learn/safe-update بروزرسانی سایت‌های وردپرسی یکی از ضروری‌ترین اقدامات برای حفظ امنیت و کارایی است. اما آپدیت اشتباه می‌تواند به قیمت قطعی سایت و از دست رفتن اطلاعات تمام شود. در این مقاله چک‌لیست کاملی برای آپدیت امن وردپرس را بررسی می‌کنیم. Wed, 26 Aug 2026 16:21:40 +0000 آموزش وردپرس https://wp-hub.org/learn/outdated-plugins https://wp-hub.org/learn/outdated-plugins نگه داشتن یک افزونه قدیمی وردپرس در سایت مثل این است که درِ ورودی خانه‌تان را برای سارقان باز بگذارید. در این مقاله به بررسی خطرات افزونه‌های بدون آپدیت می‌پردازیم. Wed, 26 Aug 2026 16:21:40 +0000 آموزش وردپرس https://wp-hub.org/learn/monthly-security https://wp-hub.org/learn/monthly-security حفظ امنیت یک سایت وردپرسی یک کار مقطعی نیست، بلکه فرآیندی مستمر است. با انجام این ۷ بررسی کوتاه به صورت ماهانه، ریسک هک شدن سایتت رو به حداقل برسون. Wed, 26 Aug 2026 16:21:40 +0000 آموزش وردپرس https://wp-hub.org/learn/cvss-guide https://wp-hub.org/learn/cvss-guide وقتی یک آسیب‌پذیری وردپرس منتشر می‌شود، معمولاً یک عدد و دسته‌بندی شدت (مثل ۹.۸ بحرانی) به همراه آن اعلام می‌شود. در این مقاله می‌فهمیم CVSS چیست و چطور باید این امتیازات را درک کنیم. Wed, 26 Aug 2026 16:21:40 +0000 آموزش وردپرس https://wp-hub.org/learn/cve-response https://wp-hub.org/learn/cve-response در دنیای امنیت وردپرس، انتشار یک CVE به معنای اعلام رسمی یک آسیب‌پذیری است. در این مقاله یاد می‌گیریم که دقیقاً بعد از شنیدن خبر یک باگ امنیتی، چه قدم‌هایی را باید برداریم تا سایت ما هک نشود. Wed, 26 Aug 2026 16:21:40 +0000 آموزش وردپرس https://wp-hub.org/learn/critical-cve-checklist https://wp-hub.org/learn/critical-cve-checklist وقتی یک آسیب‌پذیری با درجه اهمیت بحرانی (Critical CVE) برای یکی از افزونه‌ها یا قالب‌های سایتت منتشر می‌شه، دقیقه‌ها مهم هستن. این چک‌لیست به تو کمک می‌کنه تا بدون استرس و به‌صورت سیستماتیک، خطر رو مهار کنی. Wed, 26 Aug 2026 16:21:40 +0000 آموزش وردپرس https://wp-hub.org/learn/core-web-vitals https://wp-hub.org/learn/core-web-vitals شاخص‌های حیاتی وب یا Core Web Vitals معیارهای استاندارد گوگل برای سنجش سرعت واقعی، پایداری بصری و پاسخگویی به تعاملات کاربر هستند. سبز شدن این شاخص‌ها در سرچ کنسول گوگل مستقیماً رتبه ارگانیک شما را ارتقا می‌دهد. در این راهنما با نحوه عیب‌یابی و رفع آنها در وردپرس آشنا می‌شوید. Wed, 26 Aug 2026 16:21:40 +0000 آموزش وردپرس https://wp-hub.org/learn/client-handoff https://wp-hub.org/learn/client-handoff طراحی سایت تمام شده و وقت تحویل پروژه‌ست؟ قبل از اینکه کلید سایت رو به مشتری بدی، این ۵ قدم امنیتی رو حتماً اجرا کن تا هم اعتبار خودت حفظ بشه و هم سایت مشتری در امان بمونه. Wed, 26 Aug 2026 16:21:40 +0000 آموزش وردپرس https://wp-hub.org/vulnerabilities/5269 https://wp-hub.org/vulnerabilities/5269 The Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.5. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Mon, 05 Oct 2026 15:05:34 +0000 امنیت وردپرس https://wp-hub.org/vulnerabilities/5268 https://wp-hub.org/vulnerabilities/5268 The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.1. This is due to deserialization of untrusted input. This makes it possible for authenticated attackers, with custom role-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Sat, 03 Oct 2026 18:39:42 +0000 امنیت وردپرس https://wp-hub.org/vulnerabilities/5267 https://wp-hub.org/vulnerabilities/5267 The Premmerce Wishlist for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.1.13. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Thu, 01 Oct 2026 11:59:41 +0000 امنیت وردپرس https://wp-hub.org/vulnerabilities/5266 https://wp-hub.org/vulnerabilities/5266 The Social Rocket – Social Sharing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.3.5. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Mon, 05 Oct 2026 16:14:17 +0000 امنیت وردپرس https://wp-hub.org/vulnerabilities/5265 https://wp-hub.org/vulnerabilities/5265 The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.0.4. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Mon, 05 Oct 2026 11:27:01 +0000 امنیت وردپرس https://wp-hub.org/vulnerabilities/5264 https://wp-hub.org/vulnerabilities/5264 The Radius Booking – Appointment Booking Calendar & Scheduling for Services & Events plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 1.0.19. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Mon, 05 Oct 2026 16:24:39 +0000 امنیت وردپرس https://wp-hub.org/vulnerabilities/5263 https://wp-hub.org/vulnerabilities/5263 افزونه PDF Smart Viewer for Elementor تا نسخه 1.0.4 دچار آسیب‌پذیری جعل درخواست سمت سرور (SSRF) است. این نقص امنیتی به مهاجمان احرازویت‌نشده اجازه می‌دهد تا درخواست‌های وب دلخواهی را از طریق سرور میزبان ارسال کرده و به اطلاعات سرویس‌های داخلی دسترسی پیدا کنند یا آن‌ها را تغییر دهند. از آنجا که این افزونه تاکنون فاقد وصله امنیتی رسمی است، اکیداً توصیه می‌شود تا زمان انتشار به‌روزرسانی، افزونه را غیرفعال کرده یا از یک فایروال وب (WAF) برای مسدودسازی درخواست‌های مخرب استفاده کنید. Sun, 04 Oct 2026 08:24:54 +0000 امنیت وردپرس https://wp-hub.org/vulnerabilities/5262 https://wp-hub.org/vulnerabilities/5262 The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.13.1. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Wed, 30 Sep 2026 11:23:32 +0000 امنیت وردپرس https://wp-hub.org/vulnerabilities/5261 https://wp-hub.org/vulnerabilities/5261 The ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 7.8. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Mon, 05 Oct 2026 16:14:05 +0000 امنیت وردپرس https://wp-hub.org/vulnerabilities/5260 https://wp-hub.org/vulnerabilities/5260 The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.4.7. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Mon, 05 Oct 2026 16:36:53 +0000 امنیت وردپرس https://wp-hub.org/vulnerabilities/5259 https://wp-hub.org/vulnerabilities/5259 The Database for CF7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.2.6. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Mon, 05 Oct 2026 13:22:36 +0000 امنیت وردپرس https://wp-hub.org/vulnerabilities/5258 https://wp-hub.org/vulnerabilities/5258 The Gmedia Photo Gallery plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 1.25.1. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Mon, 05 Oct 2026 16:41:56 +0000 امنیت وردپرس https://wp-hub.org/vulnerabilities/5257 https://wp-hub.org/vulnerabilities/5257 The Doctreat - Hospitals and Doctors Directory WordPress Listing Theme theme for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.7.0. This is due to missing file type validation. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server, which may make remote code execution possible. Mon, 05 Oct 2026 16:33:10 +0000 امنیت وردپرس https://wp-hub.org/vulnerabilities/5256 https://wp-hub.org/vulnerabilities/5256 The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.0.19. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Fri, 02 Oct 2026 07:04:18 +0000 امنیت وردپرس https://wp-hub.org/vulnerabilities/5255 https://wp-hub.org/vulnerabilities/5255 The Video Background Block – Add Stunning Video Backgrounds to Any Section plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.0.3. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Mon, 05 Oct 2026 16:21:05 +0000 امنیت وردپرس https://wp-hub.org/vulnerabilities/5254 https://wp-hub.org/vulnerabilities/5254 The Photonic Gallery & Lightbox for Flickr, SmugMug & Others plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.36. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Wed, 30 Sep 2026 13:34:47 +0000 امنیت وردپرس https://wp-hub.org/vulnerabilities/5253 https://wp-hub.org/vulnerabilities/5253 The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.7.1. This is due to insufficient restriction on the capabilities a user may grant themselves. This makes it possible for unauthenticated attackers to elevate their privileges beyond those intended for their role. Mon, 05 Oct 2026 15:04:48 +0000 امنیت وردپرس https://wp-hub.org/vulnerabilities/5252 https://wp-hub.org/vulnerabilities/5252 The WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.4.6. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Mon, 05 Oct 2026 16:20:25 +0000 امنیت وردپرس https://wp-hub.org/vulnerabilities/5251 https://wp-hub.org/vulnerabilities/5251 The Newsletter Subscription Form – User Subscriptions Form, Capture Email plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 1.5.9. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Mon, 05 Oct 2026 15:30:57 +0000 امنیت وردپرس https://wp-hub.org/vulnerabilities/5250 https://wp-hub.org/vulnerabilities/5250 The Coder plugin for WordPress is vulnerable to Remote Code Execution in versions 4.0 through 4.5.1. This is due to insufficient validation of user supplied input before it is executed. This makes it possible for authenticated attackers, with editor-level access and above, to execute arbitrary code on the server. Mon, 05 Oct 2026 00:00:00 +0000 امنیت وردپرس https://wp-hub.org/vulnerabilities/5249 https://wp-hub.org/vulnerabilities/5249 The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.1.1. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Mon, 05 Oct 2026 12:31:53 +0000 امنیت وردپرس https://wp-hub.org/vulnerabilities/5248 https://wp-hub.org/vulnerabilities/5248 The All in One SEO plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in all versions up to, and including, 5.0.2.0. This is due to the use of do_shortcode() on user supplied input. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes registered on the site. The impact depends on which shortcodes the site has registered, so a site running a plugin whose shortcodes expose data or perform actions is affected more severely. Fri, 02 Oct 2026 00:00:00 +0000 امنیت وردپرس https://wp-hub.org/vulnerabilities/5247 https://wp-hub.org/vulnerabilities/5247 The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 5.5.82. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Fri, 02 Oct 2026 09:04:58 +0000 امنیت وردپرس https://wp-hub.org/vulnerabilities/5246 https://wp-hub.org/vulnerabilities/5246 The WPBot – ChatBot Conversational Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.5.0. This is due to deserialization of untrusted input. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Tue, 29 Sep 2026 09:44:55 +0000 امنیت وردپرس https://wp-hub.org/vulnerabilities/5245 https://wp-hub.org/vulnerabilities/5245 The SendPress Newsletters plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 1.26.1.20. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Mon, 05 Oct 2026 16:53:05 +0000 امنیت وردپرس