CVE-2026-5727 Hello Plus <= 1.7.7 - Authenticated (Contributor+) Missing Authorization to Template Activation via hello_plus_set_as_entire_site

The Hello Plus plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Contributor-level access...

WordPress Hello Plus plugin <= 1.7.7 - Authenticated (Contributor+) Missing Authorization to Template Activation vulnerability

Authenticated Contributor+ Missing Authorization to Template Activation vulnerability discovered by normaandersonfrank in WordPress Plugin Hello Plus versions = 1.7.7...

CVE-2026-81924

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery CSRF in the theme page-template activation feature. The Dashboard theme Inspect controller's activatefiles action created PageTemplate records from attacker-supplied pageTemplates values without validating an anti-CSRF token.A...

PT-2026-92395

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery CSRF in the theme page-template activation feature. The Dashboard theme Inspect controller's activate files action created PageTemplate records from attacker-supplied pageTemplates values without validating an anti-CSRF token.A...