WordPress WooCommerce PDF Invoice Builder plugin <= 2.0.8 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WooCommerce PDF Invoice Builder versions = 2.0.8...

WordPress Extra Product Options Builder for WooCommerce plugin <= 1.2.167 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by VanTastic in WordPress Plugin Extra Product Options Builder for WooCommerce versions = 1.2.167...

CVE-2026-10570

The Sympl Repeater for ACF and Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ACF repeater field values in all versions up to, and including, 2.3. This is due to insufficient input sanitization and output escaping in the symparfereplacecontent function, which uses...

CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Tuesday added four security flaws to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-48282 CVSS score: 10.0 - A path traversal vulnerability i...

Exploit for Unrestricted Upload of File with Dangerous Type in Joomlack Page_Builder_Ck

CVE-2026-56290 - Compagebuilderck Mass Exploit ⚠️ Disclai...

CVE-2026-6740: Improper Neutralization of Input During Web Page Generation

The Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'commentIcon' parameter in all versions up to, and including, 4.7.4 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2025-14785: Improper Neutralization of Input During Web Page Generation

The Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's seedprodnestedmenuwidget shortcode in all versions up to, and including, 6.20.2 due to insufficient input...

CVE-2026-10706: Undefined Security Weakness

In Adalo’s no-code app builder, Versions 1 and 2 the attackers may extract full user records and correlate user behavior across multiple applications via dbId enumeration. The platform does not implement data minimization, privacy by design, or implement appropriate technical safeguards, allowing...

PT-2026-56393

Name of the Vulnerable Software and Affected Versions Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode versions prior to 6.20.3 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping on user...

Joomla Page Builder CK 3.5.10 - Arbitrary File Upload

Exploit Title: Joomla Page Builder CK 3.5.10 - Arbitrary File Upload Google Dork: inurl:compagebuilderck OR "/components/compagebuilderck/assets/pagebuilderck.js" Date: 2026-07-04 Exploit Author: M@rAz Ali Credits: Peyman Siyahi, MR.PERSIA Vendor Homepage: https://www.joomlack.fr/ Software Link:...

CVE-2026-47830 - Incorrect Permission Assignment Allows Local Privilege Escalation to SYSTEM via Executable Overwrite | Cloud Foundry

High CVSSv4: High 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSSv3: High 8.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Vendor Cloud Foundry Foundation Versions Affected Severity is High unless otherwise noted. bosh-windows-stemcell-builder – All versions prior to...

Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods

ImpactWhen Flask-AppBuilder is configured to use OAuth, LDAP, or other non-database authentication methods, the password reset endpoint remains registered and accessible, despite not being displayed in the user interface. This allows an enabled user to reset their password and be able to create J...

GO-2026-5857 Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation in github.com/fission/fission

Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation in github.com/fission/fission...

GO-2026-5850 Fission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder container in github.com/fission/fission

Fission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder container in github.com/fission/fission...

PYSEC-2026-1323 D-Tale vulnerable to Remote Code Execution through the Query input on Chart Builder

Impact Users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server. Patches Users should upgrade to version 3.14.1 where the "Custom Filter" input is turned off by default. You can find out more information on how to turn it back...

D-Tale vulnerable to Remote Code Execution through the Query input on Chart Builder

ImpactUsers hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server. PatchesUsers should upgrade to version 3.14.1 where the "Custom Filter" input is turned off by default. You can find out more information on how to turn it back o...

WordPress Funnel Kit Funnel Builder PRO plugin <= 3.15.0.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Funnel Kit Funnel Builder PRO versions = 3.15.0.7...

WordPress Funnel Kit Funnel Builder PRO plugin <= 3.15.0.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Austin Ginder in WordPress Plugin Funnel Kit Funnel Builder PRO versions = 3.15.0.4...

WordPress Themify Builder plugin <= 7.7.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Themify Builder versions = 7.7.4...

EUVD-2026-42009

The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.12.7 via the 'postData' parameter parameter. This is due to unsanitized write of attacker-controlled postData values...