6701 matches found
CVE-2026-66490
Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox 2.20.2...
EUVD-2026-50333
Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox 2.20.2...
CVE-2026-66490
The Joomla Extension - balbooa.com (specifically Gridbox ) is vulnerable to Stored Cross-Site Scripting (XSS) in versions prior to 2.20.2 . The vulnerability is triggered via a comment avatar , where improper neutralization of input during web page generation allows an attacker to execute malicio...
CVE-2026-65884
Joomla Extension - balbooa.com - Privilege Escalation in Gridbox 2.20.2 - The registration method allows users provided usergroup IDs, allowing unauthenticated actors to register new accounts with administrative permissions...
CVE-2026-65943 Joomla Extension - rolandd.com - Unauthenticated directory creation RO CSVI < 9.11.0
Joomla Extension - rolandd.com - Unauthenticated directory creation RO CSVI 9.11.0...
CVE-2026-65943 Joomla Extension - rolandd.com - Unauthenticated directory creation RO CSVI < 9.11.0
Joomla Extension - rolandd.com - Unauthenticated directory creation RO CSVI 9.11.0...
CVE-2026-65943
The Joomla Extension by rolandd.com (specifically RO CSVI ) is vulnerable to unauthenticated directory creation in versions prior to 9.11.0 . This vulnerability is categorized as an improper access control issue, allowing an attacker to create directories without prior authentication. While the s...
CVE-2026-65946
The Joomla Extension - rolandd.com software (specifically RO CSVI ) versions prior to 9.11.0 is vulnerable to Cross-Site Scripting (XSS) . The root cause is the improper neutralization of input during web page generation within the AJAX endpoint handlers . This vulnerability could allow an attack...
EUVD-2026-50307
Joomla Extension - rolandd.com - XSS vectors in AJAX endpoint handlers RO CSVI 9.11.0...
CVE-2026-65885 Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2
Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox 2.20.2 - File upload methods allows authenticated attackers to upload arbitrary files. Turns into an authenticated RCE if combined with CVE-2026-65884 as the required account can be created by the attacker...
WordPress Sina Extension for Elementor plugin < 3.10.2 - Reflected XSS vulnerability
Reflected XSS vulnerability discovered by Mustafa Ahmed in WordPress Plugin Sina Extension for Elementor versions 3.10.2...
WordPress WowOptin: Next-Gen Popup Maker plugin < 1.4.38 - Unauthenticated Opt-in Deactivation and Template Row Injection vulnerability
Unauthenticated Opt-in Deactivation and Template Row Injection vulnerability discovered by Pedro Pinho in WordPress Plugin WowOptin versions 1.4.38...
WordPress Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content plugin < 4.16.18 - Unauthenticated Privilege Escalation vulnerability
Unauthenticated Privilege Escalation vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin ProfilePress versions 4.16.18...
WordPress security-ninja-premium plugin < 5.290 - Two-Factor Authentication Bypass vulnerability
Two-Factor Authentication Bypass vulnerability discovered by Adam Clinch in WordPress Plugin security-ninja-premium versions 5.290...
WordPress FacturaONE para WooCommerce con VeriFactu plugin < 5.37 - Unauthenticated Remote Code Execution vulnerability
Unauthenticated Remote Code Execution vulnerability discovered by Pedro Pinho in WordPress Plugin FacturaONE para WooCommerce con VeriFactu versions 5.37...
WordPress Custom Fields Account Registration For Woocommerce plugin < 1.4 - Unauthenticated Privilege Escalation vulnerability
Unauthenticated Privilege Escalation vulnerability discovered by Huynh Kien Minh in WordPress Plugin Custom Fields Account Registration For Woocommerce versions 1.4...
WordPress MainWP Child plugin < 6.1.2 - Unauthenticated Administrator Authentication Bypass vulnerability
Unauthenticated Administrator Authentication Bypass vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin MainWP Child versions 6.1.2...
PT-2026-65806
Joomla Extension - balbooa.com - Payment bypass in Gridbox 2.20.2...
PT-2026-65792
Name of the Vulnerable Software and Affected Versions RO CSVI versions prior to 9.11.0 Description Cross-Site Request Forgery CSRF vectors exist in the AJAX endpoint handlers of the rolandd.com Joomla Extension. CSRF is a type of attack that tricks a victim into submitting a malicious request. It...