PT-2026-80811

Author SQL Injection in FluentCRM Pro = 3.1.12 versions...

PT-2026-80814

Subscriber Insecure Direct Object References IDOR in Fluent Boards Pro = 2.0.11 versions...

CVE-2026-32563: Deserialization of Untrusted Data

Subscriber PHP Object Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...

CVE-2026-78278: Authorization Bypass Through User-Controlled Key

Subscriber Insecure Direct Object References IDOR in Fluent Boards Pro = 2.0.11 versions...

CVE-2026-66587: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in WP Cafe Pro 3.0.15 versions...

CVE-2026-78277: Server-Side Request Forgery (SSRF)

Subscriber Server Side Request Forgery SSRF in FluentCRM Pro = 3.1.12 versions...

CVE-2026-66585: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in WP Cafe Pro 3.0.15 versions...

PT-2026-80834

Unauthenticated Arbitrary File Deletion in ShopBuilder Pro – Elementor WooCommerce Builder Addons = 2.2.0 versions...

PT-2026-80835

Subscriber SQL Injection in WP Project Manager Pro = 4.0.1 versions...

PT-2026-80833

Unauthenticated Cross Site Scripting XSS in Brave Conversion Engine PRO = 0.8.6 versions...

PT-2026-80837

Unauthenticated Privilege Escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPress = 8.9.1 versions...

PT-2026-80838

Unauthenticated Sensitive Data Exposure in WP Cafe Pro 3.0.15 versions...

CVE-2026-76613

Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 - An SQL injection allowed any contributor-level user to inject own content into SQL queries...

CVE-2026-75115

Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40 - The Filesystem source's path filter is vulnerable to glob-based pattern attacks, allowing authorized users to read arbitrary files...

EUVD-2026-63938

Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40 - The Filesystem source's path filter is vulnerable to glob-based pattern attacks, allowing authorized users to read arbitrary files...

CVE-2026-75115 Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40

Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40 - The Filesystem source's path filter is vulnerable to glob-based pattern attacks, allowing authorized users to read arbitrary files...

CVE-2026-75115

YOOtheme Pro (a Joomla extension by yootheme.com) versions 2.3.0 through 5.0.40 are affected by an authenticated arbitrary file read vulnerability. The root cause is that the Filesystem source's path filter is vulnerable to glob-based pattern attacks , allowing authorized users with privileged ac...

CVE-2026-75115 Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40

Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40 - The Filesystem source's path filter is vulnerable to glob-based pattern attacks, allowing authorized users to read arbitrary files...

EUVD-2026-63937

Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 - An SQL injection allowed any contributor-level user to inject own content into SQL queries...

CVE-2026-76613 Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40

Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 - An SQL injection allowed any contributor-level user to inject own content into SQL queries...