WordPress vulnerabilities, September 2026: the ones on sites people actually run

Thirty-five critical records in twenty-one days. The plugins with real install numbers behind them, the version that fixes each one, the core release nobody should miss, and the one that no version can fix.