CVE-2026-66494 Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0

Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder 6.7.0 - An unauthenticated attacker can store malicious JavaScript in a Joomla site's database via a single HTTP request. When an administrator opens the SP Page Builder editor, the JavaScript...

PT-2026-69039

Name of the Vulnerable Software and Affected Versions SP Page Builder versions prior to 6.7.0 Description An unauthenticated attacker can perform a stored Cross-Site Scripting XSS attack—where malicious scripts are permanently stored on the target server—by sending a single HTTP request to the...

CVE-2026-66494: Improper Access Control

Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder 6.7.0 - An unauthenticated attacker can store malicious JavaScript in a Joomla site's database via a single HTTP request. When an administrator opens the SP Page Builder editor, the JavaScript...

CVE-2026-66701

Unauthenticated Broken Access Control in Profile Builder = 3.16.5 versions...

CVE-2026-66701 WordPress Profile Builder plugin <= 3.16.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Profile Builder = 3.16.5 versions...

CVE-2026-66701 WordPress Profile Builder plugin <= 3.16.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Profile Builder = 3.16.5 versions...

CVE-2026-66701

CVE-2026-66701 affects the WordPress Profile Builder plugin (versions

CVE-2026-66701

Unauthenticated Broken Access Control in Profile Builder = 3.16.5 versions...

EUVD-2026-53905

Unauthenticated Broken Access Control in Profile Builder = 3.16.5 versions...

CVE-2026-66425

Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder = 1.9.0 versions...

EUVD-2026-53880

Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder = 1.9.0 versions...

CVE-2026-66425

Technical details are not publicly available in the provided documents. Monitor for updates from the listed sources.

WordPress Cost Calculator Builder plugin <= 3.6.17 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure vulnerability

Missing Authorization to Authenticated Subscriber+ Sensitive Information Disclosure vulnerability discovered by momopon1415 in WordPress Plugin Cost Calculator Builder versions = 3.6.17...

CVE-2025-15028: Improper Neutralization of Input During Web Page Generation

The FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission fields in all versions up to, and including, 1.9.2 due to insufficient input sanitization and output escaping. This...

PT-2026-68595

Name of the Vulnerable Software and Affected Versions Profile Builder versions prior to 3.16.6 Description Unauthenticated Broken Access Control allows an attacker to bypass authorization restrictions without providing valid credentials. Recommendations Update to a version newer than 3.16.5...

CVE-2026-66701: Missing Authorization

Unauthenticated Broken Access Control in Profile Builder = 3.16.5 versions...

MAL-2026-13232 Malicious code in bigops-plugin-notification-builder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 829800a4393389fef48ff06ea586a4892215acc428700193652bd1f3ce3f71b0 On require/import, index.js unconditionally loads bridge.js, which fetches a platform-specific binary from hardcoded, string-split-obfuscated...

Malicious code in contract-contract-builder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3758ab87194c554acffc80e8cd2caf8fa8890e92854115edab08615877f22b5f On require of the package, platform.js downloads a platform-specific binary from Cloudflare Workers hosts whose names are assembled at runtime from...

MAL-2026-12665 Malicious code in contract-contract-builder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3758ab87194c554acffc80e8cd2caf8fa8890e92854115edab08615877f22b5f On require of the package, platform.js downloads a platform-specific binary from Cloudflare Workers hosts whose names are assembled at runtime from...

CVE-2026-71288

Koha's guided report builder reports/guidedreports.pl reads the CGI parameter and, for each value, a dynamically-named parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation. Since ORDER BY columns cannot be bound via prepared-statement placeholders,...