CVE-2026-16569: Improper Access Control

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not check the user's capabilities before allowing a stock-update operation through one of its REST endpoints, allowing any authenticated user, such as a customer or subscriber...

CVE-2026-81335: Missing Authorization

Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch and record-name views in backend/src/baserow/contrib/builder/api/datasources/views.py are declared with a permission class that admits any caller, so a request carrying no...

PT-2026-82743

Name of the Vulnerable Software and Affected Versions MongoDB C Driver affected versions not specified Description Improper neutralization of delimiters during connection-URL construction enables connection-option injection. This occurs when an application passes untrusted text into the driver's...

DRUPAL-CONTRIB-2026-112

The DXPR Builder module provides a visual / AI page builder for Drupal. The module uses a JSON Web Token for licensing, user license management, AI services, and subscription metadata. The 2.x version of the module does not sufficiently restrict access to API credentials in JavaScript settings...

@adobe/aem-site-template-builder (>=0.1.7, <=2.0.2), @ns3/nx-serverless (>=3.2.2, <=4.1.0) +8 more potentially affected by CVE-2026-80427 via bestzip (>=1.1.3, <=2.2.1)

bestzip NPM version =1.1.3, =0.1.7, =3.2.2, =0.3.0, =0.2.0, =1.0.0, =1.0.0, =1.0.7-6, =1.0.2-1, =0.0.1, =1.0.0, =1.0.2 Source cves: CVE-2026-80427 Source advisory: MEND:CVE-2026-80427...

WordPress Brizy - Page Builder plugin < 2.8.19 - Contributor+ Template Type Update via IDOR vulnerability

WordPress Brizy - Page Builder plugin 2.8.19 - Contributor+ Template Type Update via IDOR vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Brizy versions 2.8.19...

WordPress Fusion Builder plugin <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write vulnerability

Unauthenticated Remote Code Execution via Arbitrary File Write vulnerability discovered by WordFence in WordPress Plugin Fusion Builder versions = 3.16...

CVE-2026-18431

The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two...

CVE-2026-18431 Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write

The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two...

CVE-2026-18431

The Avada WordPress theme (≤ 7.16) combined with the Fusion Builder plugin (≤ 3.16) is vulnerable to unauthenticated Remote Code Execution via a chain of six authorization and input validation weaknesses enabling arbitrary file write. An attacker can create and execute arbitrary PHP files, leadin...

EUVD-2026-66293

The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two...

CVE-2026-18431 Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write

The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two...

isms-builder v1.37.5.3

ISMS Builder Self-hosted Information Security Management System — open source, no cloud required ⚠️ Security Warning: Fake repositories and copies distributing malware ISMS Builder has no packaged "releases", installers, or downloadable ZIP files — the only legitimate source is this repository,...

CVE-2026-18331: Improper Neutralization of Input During Web Page Generation

The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'frmuserid' parameter in all versions up to, and including, 6.33.1 due to insufficient input sanitization and output escaping. Thi...

CVE-2026-5092: Improper Neutralization of Input During Web Page Generation

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customapi action handler in versions up to, and including, 12.8.9. This is due to insufficient sanitization of API responses before output via innerHTML. This makes it...

DXPR Builder: The AI Visual Page Builder for Drupal - Moderately critical - Information Disclosure - SA-CONTRIB-2026-112

The DXPR Builder module provides a visual / AI page builder for Drupal. The module uses a JSON Web Token for licensing, user license management, AI services, and subscription metadata. The 2.x version of the module does not sufficiently restrict access to API credentials in JavaScript settings...

CVE-2026-18431: Missing Authorization

The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two...

PT-2026-82366

Name of the Vulnerable Software and Affected Versions DXPR Builder: The Best Editing AI Experience for Drupal versions 0.0.0 through 2.8.1 Description DXPR Builder allows Forceful Browsing due to the insertion of sensitive information into sent data. In the 2.x version, the module does not...

PT-2026-81951

Name of the Vulnerable Software and Affected Versions Avada versions prior to 7.16.1 Fusion Builder versions prior to 3.16.1 Description An unauthenticated attacker can achieve remote code execution and complete site compromise by writing attacker-controlled PHP files to the server. This is...

WordPress Themify Builder plugin <= 7.8.0 - Missing Authorization to Unauthenticated Arbitrary Builder Data Modification via 'tb_update_old_data' AJAX Action vulnerability

Missing Authorization to Unauthenticated Arbitrary Builder Data Modification via 'tbupdateolddata' AJAX Action vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Themify Builder versions = 7.8.0...