Websites, CMS and e-commerce: vulnerabilities and fixes

WordPress, Drupal, Joomla, Magento, WooCommerce and Moodle. 357 CVEs tracked.

Websites, CMS and e-commerce has 357 tracked vulnerabilities, 61 critical and 4 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 206. Most recent: 2026-10-24. Highest priority: CVE-2026-75650 (score 96/100).

• CVE-2026-75650 CRITICAL 10.0 EXPLOITED UPGRADE UPGRADE Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability
• CVE-2026-71362 CRITICAL 9.1 EXPLOITED UPGRADE UPGRADE Adobe Commerce and Magento Incorrect Authorization Vulnerability
• CVE-2026-87902 HIGH 8.1 EXPLOITED UPGRADE WordPress Core Remote File Inclusion Vulnerability
• CVE-2023-22894 MEDIUM 4.9 EXPLOITED UPGRADE Strapi Cleartext Storage of Sensitive Information Vulnerability
• CVE-2026-15748 CRITICAL 9.8 The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and in
• CVE-2023-25207 CRITICAL 9.8 UPGRADE PrestaShop dpdfrance <6.1.3 is vulnerable to SQL Injection via dpdfrance/ajax.php.
• CVE-2023-30191 CRITICAL 9.8 UPGRADE PrestaShop cdesigner < 3.1.9 is vulnerable to SQL Injection via CdesignerTraitementModuleFrontController::init
• CVE-2023-2288 HIGH 8.8 UPGRADE The Otter WordPress plugin before 2.2.6 does not sanitize some user-controlled file paths before performing fi
• CVE-2026-45618 CRITICAL 10.0 LiquidJS is a Shopify/GitHub Pages compatible template engine
• CVE-2026-65761 CRITICAL 9.3 Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 - Improp
• CVE-2026-65880 CRITICAL 10.0 Joomla Extension - balbooa.com - Unauthenticated remote code execution in Balbooa Forms < 2.4.3 - An insecure
• CVE-2026-66915 CRITICAL 10.0 Joomla Extension - fabrikar.com - Remote code execution in Fabrik < 4.7.2 - An unauthenticated attacker could
• CVE-2026-67282 CRITICAL 10.0 Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.6.8 - An unauthenticated
• CVE-2026-102785 CRITICAL 10.0 Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOthem
• CVE-2026-65883 CRITICAL 9.8 UPGRADE Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 2
• CVE-2026-66914 CRITICAL 9.2 Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD < 3.30.0, < 4.7.0, < 6.0.1 - An unaut
• CVE-2026-76604 CRITICAL 10.0 Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.2
• CVE-2026-76605 CRITICAL 10.0 Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.2.
• CVE-2026-8457 CRITICAL 9.8 The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up
• CVE-2026-109219 CRITICAL 9.8 The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in version 2.4.4 via the mbw_file_u
• CVE-2026-65553 CRITICAL 10.0 Unauthenticated Remote Code Execution (RCE) in Spider Analyser &#8211; WordPress搜索引擎蜘蛛分析插件 <= 2.1.3 versions.
• CVE-2026-115806 CRITICAL 9.8 The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versi
• CVE-2026-40725 CRITICAL 9.8 Unauthenticated PHP Object Injection in WooCommerce Product Filters < 2.0.6 versions.
• CVE-2026-56292 HIGH 7.5 UPGRADE Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1 - A SQLi vulnerability in
• CVE-2026-60024 CRITICAL 9.8 Joomla Extension - joomdonation.com - Insecure default configuration Events Booking < 5.8.0 - The Joomla exten
• CVE-2026-65431 CRITICAL 9.8 Joomla Extension - regularlabs.com - Zipslip in GeoIP extension - Geo IP database update archives have been br
• CVE-2026-64796 CRITICAL 9.8 Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free did not requ
• CVE-2026-64874 CRITICAL 9.8 Joomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extension - CDN credentials were
• CVE-2026-65879 CRITICAL 9.8 Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page
• CVE-2026-65884 CRITICAL 9.8 UPGRADE Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2 - The registration method allows use
• CVE-2026-65887 CRITICAL 9.8 UPGRADE Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2 - The resetPassw
• CVE-2026-65888 CRITICAL 9.8 UPGRADE Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2 - The socialLogin method a
• CVE-2026-76606 CRITICAL 10.0 Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.2.
• CVE-2026-28005 CRITICAL 9.8 Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer <= 1.5.19 versions.
• CVE-2026-61424 CRITICAL 10.0 Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds < 3.11.2 - The
• CVE-2026-64873 CRITICAL 9.8 Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custom query URLs could access inte
• CVE-2026-73373 CRITICAL 9.8 UPGRADE Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The defau
• CVE-2023-28663 HIGH 8.8 UPGRADE The Formidable PRO2PDF WordPress Plugin, version < 3.11, is affected by an authenticated SQL injection vulnera
• CVE-2026-76607 CRITICAL 10.0 Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.2.
• CVE-2026-77995 CRITICAL 10.0 Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0, OAuth Singl
• CVE-2026-11801 HIGH 7.5 The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to authorization bypass in all versions
• CVE-2026-65890 CRITICAL 9.8 UPGRADE Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2 - Multiple SQLi vectors all
• CVE-2026-62415 CRITICAL 9.1 Joomla Extension - joomdonation.com - Insecure default configuration Membership Pro < 4.6.2 - The Joomla exten
• CVE-2026-64793 CRITICAL 9.1 Joomla Extension - regularlabs.com - Content access and publication bypass in Articles Anywhere and Modules An
• CVE-2026-64798 CRITICAL 9.1 Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension - Persistent URL login keys
• CVE-2026-74253 CRITICAL 10.0 Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer
• CVE-2026-76571 CRITICAL 9.3 Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik <
• CVE-2026-14488 CRITICAL 9.1 The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the template_redirect dispatc
• CVE-2026-62414 CRITICAL 9.1 Joomla Extension - joomlack.fr - Improper access control in Page Builder CK < 3.6.2 - The Joomla extension Pag
• CVE-2026-67285 CRITICAL 9.2 Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder < 6.
• CVE-2026-74254 CRITICAL 9.3 Joomla Extension - joomlack.fr - SQL injection in Page Builder CK < 3.6.5 - The Joomla extension Page Builder
• CVE-2026-76602 CRITICAL 9.3 Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.2 - The order para
• CVE-2026-77992 CRITICAL 9.5 Joomla Extension - fabrikar.com - heredoc terminator breakout in the calc element in Fabrik < 4.7.2 - The onUp
• CVE-2026-77994 CRITICAL 9.3 Joomla Extension - joomlack.fr - Second order SQL injection in Page Builder CK < 3.6.5 - The Joomla extension
• CVE-2014-125134 HIGH 7.5 ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability that allows unauthenticated a
• CVE-2026-55826 HIGH 8.7 The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites
• CVE-2026-115497 HIGH 7.5 The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all version
• CVE-2026-47247 HIGH 7.5 UPGRADE libheif is a HEIF and AVIF file format decoder and encoder
• CVE-2026-59549 CRITICAL 9.3 Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions.
• CVE-2026-60027 HIGH 8.7 Joomla Extension - themexpert.com - Unauthenticated path traversal / file read in Quix Page Builder < 6.2.1 -
• CVE-2026-65760 CRITICAL 9.2 Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store ext
• CVE-2026-65766 CRITICAL 9.2 Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.1 - Improper valid
• CVE-2026-66436 CRITICAL 9.3 Unauthenticated SQL Injection in Active Products Tables for WooCommerce <= 1.1.1 versions.
• CVE-2026-66447 CRITICAL 9.3 Unauthenticated SQL Injection in WordPress File Upload <= 5.1.7 versions.
• CVE-2026-96355 CRITICAL 9.1 Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows C
• CVE-2025-48089 CRITICAL 9.3 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Rainbow-
• CVE-2026-14270 HIGH 8.8 The Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) plugin for WordPress is
• CVE-2026-65759 HIGH 8.7 Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1
• CVE-2026-65876 CRITICAL 9.2 Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.8.0 - Improper valid
• CVE-2026-76597 HIGH 8.7 Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in F
• CVE-2026-76598 HIGH 8.7 Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjax_getFolders in Fabrik
• CVE-2014-125133 HIGH 7.5 NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthentica
• CVE-2026-110956 CRITICAL 9.8 The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor b
• CVE-2026-55685 HIGH 7.5 UPGRADE React Router is a router for React
• CVE-2026-57832 HIGH 8.7 Joomla Extension - joomdonation.com - Unauthenticated blind SQL injection in EDocman < 3.9 - The Joomla extens
• CVE-2026-76596 HIGH 8.7 Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik < 4.7.2- The lis
• CVE-2026-76599 HIGH 8.7 Joomla Extension - fabrikar.com - Unauthenticated database table list and table-prefix disclosure in Fabrik <
• CVE-2016-20100 HIGH 7.5 Memphis Documents Library plugin for WordPress before 3.1.6 contains a path traversal vulnerability that allow
• CVE-2025-48090 HIGH 8.1 Path Traversal: '.../...//' vulnerability in CocoBasic Blanka - One Page WordPress Theme blanka-wp allows PHP
• CVE-2026-65886 HIGH 7.5 UPGRADE Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2 - The photo viewer al
• CVE-2026-67363 HIGH 7.7 Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2 - The stripeChar
• CVE-2015-20124 HIGH 7.5 Aspose Importer & Exporter plugin for WordPress before 3.0 contains a path traversal vulnerability that allows
• CVE-2016-20101 HIGH 8.1 Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthen
• CVE-2026-58078 HIGH 8.7 Joomla Extension - themexpert.com - Unauthenticated SQL injection in Quix Page Builder Pro < 6.2.1 - The Jooml
• CVE-2026-60026 HIGH 8.9 Joomla Extension - themexpert.com - Authenticated PHP code execution in Quix Page Builder < 6.2.1 - The Joomla
• CVE-2026-60034 CRITICAL 9.4 Joomla Extension - themexpert.com - Authenticated stored XSS in JMedia Extension < 1.6.0 - The Joomla extensio
• CVE-2026-65754 HIGH 7.5 Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension - ReReplacer XML inclu
• CVE-2026-65885 HIGH 8.8 UPGRADE Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2 - File upload methods
• CVE-2026-73181 HIGH 7.5 Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce < 7.6 versions.
• CVE-2026-82814 HIGH 8.8 The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions
• CVE-2026-94267 CRITICAL 9.0 The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO Wor
• CVE-2017-20287 HIGH 7.5 Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated
• CVE-2022-51021 HIGH 8.2 NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability
• CVE-2026-59531 HIGH 7.5 Unauthenticated Unknown in Falcon – WordPress Optimizations & Tweaks <= 2.10.0 versions.
• CVE-2026-60032 CRITICAL 9.4 Joomla Extension - themexpert.com - Authenticated arbitrary file upload in JMedia < 1.6.0 - The Joomla extensi
• CVE-2026-63048 CRITICAL 9.4 Joomla Extension - joomlack.fr - Improper access control in Page Builder CK 1.0.0-3.1.2, 3.4.0-3.4.11, 3.5.0-3
• CVE-2026-66494 HIGH 8.7 Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0
• CVE-2026-66917 HIGH 8.6 Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.4.0 - An authenticated, privileged c
• CVE-2026-71573 HIGH 8.3 UPGRADE Joomla! Core - [20260802] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper i
• CVE-2026-73337 HIGH 7.5 UPGRADE Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient sta
• CVE-2026-96365 HIGH 7.5 Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessive Allocati
• CVE-2012-20002 HIGH 7.5 TinyMCE Thumbnail Gallery plugin for WordPress before 1.1.0 contains a path traversal vulnerability that allow
• CVE-2015-20123 HIGH 7.5 Aspose Doc Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauth
• CVE-2015-20125 HIGH 7.5 Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauth
• CVE-2017-20289 HIGH 7.5 Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability t
• CVE-2026-102786 HIGH 8.6 Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Ph
• CVE-2026-63685 HIGH 8.8 Joomla Extension - regularlabs.com - Authorization bypass in DB Replacer extension - Administrator routes and
• CVE-2026-64792 HIGH 7.5 Joomla Extension - regularlabs.com - disclosure of restricted content via search index in various Regular Labs
• CVE-2026-64799 HIGH 7.5 Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere e
• CVE-2026-65430 HIGH 7.5 Joomla Extension - regularlabs.com - MaxMind Credential leakage in GeoIP extension - MaxMind credentials where
• CVE-2026-65755 HIGH 7.5 Joomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Articles Anywhere and Users Anywher
• CVE-2026-65881 HIGH 7.5 Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomd
• CVE-2026-65889 HIGH 7.5 UPGRADE Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion < 2.20.2 - The generateNewApp me
• CVE-2026-66462 HIGH 7.5 Unauthenticated Sensitive Data Exposure in WooCommerce Appointments <= 5.3.8 versions.
• CVE-2026-76611 MEDIUM 6.9 Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo <
• CVE-2016-20103 HIGH 7.5 Cherry Plugin for WordPress before 1.2.7 contains a path traversal vulnerability that allows unauthenticated a
• CVE-2023-28665 MEDIUM 5.4 UPGRADE The Woo Bulk Price Update WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripti
• CVE-2026-57833 HIGH 8.6 Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics < 5.0.2 - The Joomla extension 4Analy
• CVE-2026-63047 HIGH 7.5 Joomla Extension - joomdonation.com - Invoice data exfiltration via incorrect ACL check in Events Booking 5.0.
• CVE-2026-63683 HIGH 7.5 Joomla Extension - regularlabs.com - Client IP spoofing vulnerability in Regular Labs conditions manager - IP
• CVE-2026-65500 HIGH 7.5 Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPress Theme <=
• CVE-2026-65758 HIGH 8.2 Joomla Extension - tassos.gr - Sensitive data exposure in Convert Forms extension 2.5.0-5.2.2 - The front-end
• CVE-2026-65878 HIGH 8.3 Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder < 6.7.1- Improper p
• CVE-2026-65943 HIGH 7.5 UPGRADE Joomla Extension - rolandd.com - Unauthenticated directory creation RO CSVI < 9.11.0
• CVE-2026-66491 HIGH 8.2 Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3 - Improper limitation of path
• CVE-2026-76612 HIGH 8.6 Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66 - User
• CVE-2026-77027 HIGH 8.6 Joomla Extension - fabrikar.com - Unauthenticated stored XSS in Fabrik < 4.7.2 - The handling of user supplied
• CVE-2026-94268 HIGH 8.1 The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO Wor
• CVE-2026-27345 HIGH 7.5 Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce <= 2.0.3 versions.
• CVE-2026-59530 HIGH 7.5 Unauthenticated Broken Access Control in Stripe For WooCommerce <= 4.0.7 versions.
• CVE-2026-59547 HIGH 7.5 Unauthenticated Broken Access Control in Payment Gateway for PayPal on WooCommerce <= 9.1.4 versions.
• CVE-2026-60031 MEDIUM 6.9 Joomla Extension - themexpert.com - Information disclosure in Quix Page Builder < 6.2.1 - The Joomla extension
• CVE-2026-64797 HIGH 7.5 Joomla Extension - regularlabs.com - IP spoofing vulnerability in IP login extension - IP Login trusted forwar
• CVE-2026-66431 HIGH 7.5 Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) <= 1.0.
• CVE-2026-66466 HIGH 7.5 Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Dir
• CVE-2026-66916 MEDIUM 6.9 Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery
• CVE-2026-67283 MEDIUM 6.9 Joomla Extension - tabaoca.org - Improper ACL implementation allows file operations in Cotton Cloud < 2.0.2 -
• CVE-2026-67286 MEDIUM 6.3 Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Bui
• CVE-2026-76600 MEDIUM 6.9 Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik < 4.7.2 - The DeleteCommen
• CVE-2026-76601 MEDIUM 6.9 Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik < 4.7.2 - The order plugin did not
• CVE-2026-76603 MEDIUM 6.9 Joomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik < 4.7.2 - The i
• CVE-2026-76608 MEDIUM 6.9 Joomla Extension - fabrikar.com - Unauthenticated disclosure of any commenter's email address in Fabrik < 4.7.
• CVE-2026-76609 MEDIUM 6.9 Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik < 4.7.2 - The onUpdate
• CVE-2026-104068 HIGH 7.2 JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability th
• CVE-2026-109198 HIGH 7.2 The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cros
• CVE-2026-22335 HIGH 8.5 Subscriber SQL Injection in WooCommerce Frontend Manager – Ultimate < 6.7.7 versions.
• CVE-2026-59551 HIGH 8.5 Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions.
• CVE-2026-65877 HIGH 8.2 Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder < 6.7.1 - Improper validat
• CVE-2026-39472 HIGH 7.2 Shop manager PHP Object Injection in WooCommerce PDF Invoices & Packing Slips < 5.9.0 versions.
• CVE-2026-67287 MEDIUM 6.3 Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder < 6.8.0 - An unauthent

FAQ

How do I fix Websites, CMS and e-commerce vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Websites, CMS and e-commerce being exploited right now?

Yes: 4 Websites, CMS and e-commerce CVEs are on the CISA Known Exploited Vulnerabilities list, so patch those first.

Which Websites, CMS and e-commerce CVE should I patch first?

CVE-2026-75650 currently ranks highest (96/100): Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability.

Software in this group

People search for: wordpress, drupal, joomla, magento, plugin.

← Back to latest CVEs