CVE-2026-77034 - Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager < 5.0.1
CVE ID :CVE-2026-77034
Published : Aug. 27, 2026, 6:17 a.m. | 1 hour, 24 minutes ago
Description :Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager < 5.0.1 - Any visitor holding their own session token can republish and overwrite an article associated with an event.
Severity: 6.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-77034
Published : Aug. 27, 2026, 6:17 a.m. | 1 hour, 24 minutes ago
Description :Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager < 5.0.1 - Any visitor holding their own session token can republish and overwrite an article associated with an event.
Severity: 6.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-77035 - Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager < 5.0.1
CVE ID :CVE-2026-77035
Published : Aug. 27, 2026, 6:17 a.m. | 1 hour, 24 minutes ago
Description :Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager < 5.0.1 - A registered user with edit-own rights (the eventowner=1 setting or core.edit.own) can POST another user's record id together with their own id as created_by and take over that record.
Severity: 5.1 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-77035
Published : Aug. 27, 2026, 6:17 a.m. | 1 hour, 24 minutes ago
Description :Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager < 5.0.1 - A registered user with edit-own rights (the eventowner=1 setting or core.edit.own) can POST another user's record id together with their own id as created_by and take over that record.
Severity: 5.1 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-77989 - Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager < 5.0.1
CVE ID :CVE-2026-77989
Published : Aug. 27, 2026, 6:17 a.m. | 1 hour, 24 minutes ago
Description :Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager < 5.0.1 - buildCurrentPdfLink copies the current request query string into the PDF button URL, and pdfbutton() echoes it unescaped, leading to an reflected XSS vector.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-77989
Published : Aug. 27, 2026, 6:17 a.m. | 1 hour, 24 minutes ago
Description :Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager < 5.0.1 - buildCurrentPdfLink copies the current request query string into the PDF button URL, and pdfbutton() echoes it unescaped, leading to an reflected XSS vector.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-77990 - Joomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in Joomla Event Manager < 5.0.1
CVE ID :CVE-2026-77990
Published : Aug. 27, 2026, 6:17 a.m. | 1 hour, 24 minutes ago
Description :Joomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in Joomla Event Manager < 5.0.1 - A non-manager can therefore read attendee names, usernames, registration dates and statuses for events they do not manage, including lists belonging to unpublished events.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-77990
Published : Aug. 27, 2026, 6:17 a.m. | 1 hour, 24 minutes ago
Description :Joomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in Joomla Event Manager < 5.0.1 - A non-manager can therefore read attendee names, usernames, registration dates and statuses for events they do not manage, including lists belonging to unpublished events.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-77991 - Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1
CVE ID :CVE-2026-77991
Published : Aug. 27, 2026, 6:17 a.m. | 1 hour, 24 minutes ago
Description :Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1 - The administrator source model allows to write dangerous file type incl. PHP, leading to remote code execution.
Severity: 9.4 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-77991
Published : Aug. 27, 2026, 6:17 a.m. | 1 hour, 24 minutes ago
Description :Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1 - The administrator source model allows to write dangerous file type incl. PHP, leading to remote code execution.
Severity: 9.4 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-78125 - LearnPress – Sepay Payment < 4.0.3 - Unauthenticated Order Status Disclosure
CVE ID :CVE-2026-78125
Published : Aug. 27, 2026, 6:17 a.m. | 1 hour, 24 minutes ago
Description :The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthenticated attackers to disclose the payment status of arbitrary orders by enumerating order identifiers.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-78125
Published : Aug. 27, 2026, 6:17 a.m. | 1 hour, 24 minutes ago
Description :The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthenticated attackers to disclose the payment status of arbitrary orders by enumerating order identifiers.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-78137 - StoreGrowth: Smart Sales Booster for WooCommerce < 2.1.2 - Unauthenticated Arbitrary Price Manipulation via BOGO Add-to-Cart
CVE ID :CVE-2026-78137
Published : Aug. 27, 2026, 6:17 a.m. | 1 hour, 24 minutes ago
Description :The StoreGrowth WordPress plugin before 2.1.2 does not validate a browser-supplied product price on two of its unauthenticated actions, allowing unauthenticated attackers to add a product to the cart at an arbitrary, attacker-chosen price that carries through to the checkout total when the BOGO offer feature is enabled.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-78137
Published : Aug. 27, 2026, 6:17 a.m. | 1 hour, 24 minutes ago
Description :The StoreGrowth WordPress plugin before 2.1.2 does not validate a browser-supplied product price on two of its unauthenticated actions, allowing unauthenticated attackers to add a product to the cart at an arbitrary, attacker-chosen price that carries through to the checkout total when the BOGO offer feature is enabled.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-78138 - Finale Lite < 2.21.0 - Subscriber+ Campaign Configuration Disclosure via wcct_quick_view_html
CVE ID :CVE-2026-78138
Published : Aug. 27, 2026, 6:17 a.m. | 1 hour, 24 minutes ago
Description :The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbitrary post ID, allowing any authenticated user (Subscriber and above) to read the Finale Lite WordPress plugin before 2.21.0's campaign configuration and scheduling data.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-78138
Published : Aug. 27, 2026, 6:17 a.m. | 1 hour, 24 minutes ago
Description :The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbitrary post ID, allowing any authenticated user (Subscriber and above) to read the Finale Lite WordPress plugin before 2.21.0's campaign configuration and scheduling data.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-78139 - Notifima < 3.1.4 - Subscriber+ Stock Alert Unsubscription via IDOR
CVE ID :CVE-2026-78139
Published : Aug. 27, 2026, 6:17 a.m. | 1 hour, 24 minutes ago
Description :The Notifima WordPress plugin before 3.1.4 does not verify that the caller owns the subscription being modified on one of its REST endpoints in all versions up to, and including, 3.1.3, allowing authenticated attackers with Subscriber-level access to unsubscribe arbitrary customers from product stock-alert notifications.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-78139
Published : Aug. 27, 2026, 6:17 a.m. | 1 hour, 24 minutes ago
Description :The Notifima WordPress plugin before 3.1.4 does not verify that the caller owns the subscription being modified on one of its REST endpoints in all versions up to, and including, 3.1.3, allowing authenticated attackers with Subscriber-level access to unsubscribe arbitrary customers from product stock-alert notifications.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-78333 - 12 Step Meeting List 3.17 - 3.19.16 - Unauthenticated Stored XSS via Geocode Event Log
CVE ID :CVE-2026-78333
Published : Aug. 27, 2026, 6:17 a.m. | 1 hour, 24 minutes ago
Description :The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area page, leading to a Stored Cross-Site Scripting issue which could be used against high privilege users such as admin.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-78333
Published : Aug. 27, 2026, 6:17 a.m. | 1 hour, 24 minutes ago
Description :The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area page, leading to a Stored Cross-Site Scripting issue which could be used against high privilege users such as admin.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-78276 - WordPress Fluent Boards Pro plugin <= 2.0.11 - PHP Object Injection vulnerability
CVE ID :CVE-2026-78276
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :Editor PHP Object Injection in Fluent Boards Pro <= 2.0.11 versions.
Severity: 7.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-78276
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :Editor PHP Object Injection in Fluent Boards Pro <= 2.0.11 versions.
Severity: 7.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-78281 - WordPress CP Media Player plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability
CVE ID :CVE-2026-78281
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :Unauthenticated Cross Site Scripting (XSS) in CP Media Player <= 1.3.0 versions.
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-78281
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :Unauthenticated Cross Site Scripting (XSS) in CP Media Player <= 1.3.0 versions.
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-78283 - WordPress Music Player for WooCommerce plugin <= 1.8.9 - Cross Site Scripting (XSS) vulnerability
CVE ID :CVE-2026-78283
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :Unauthenticated Cross Site Scripting (XSS) in Music Player for WooCommerce <= 1.8.9 versions.
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-78283
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :Unauthenticated Cross Site Scripting (XSS) in Music Player for WooCommerce <= 1.8.9 versions.
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-78285 - WordPress Like Button Rating plugin <= 2.6.61 - SQL Injection vulnerability
CVE ID :CVE-2026-78285
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :Subscriber SQL Injection in Like Button Rating <= 2.6.61 versions.
Severity: 8.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-78285
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :Subscriber SQL Injection in Like Button Rating <= 2.6.61 versions.
Severity: 8.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-78286 - WordPress Geo Controller plugin <= 8.9.8 - PHP Object Injection vulnerability
CVE ID :CVE-2026-78286
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :Unauthenticated PHP Object Injection in Geo Controller <= 8.9.8 versions.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-78286
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :Unauthenticated PHP Object Injection in Geo Controller <= 8.9.8 versions.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-78288 - WordPress Beautiful Taxonomy Filters plugin <= 2.4.6 - SQL Injection vulnerability
CVE ID :CVE-2026-78288
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :Unauthenticated SQL Injection in Beautiful Taxonomy Filters <= 2.4.6 versions.
Severity: 9.3 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-78288
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :Unauthenticated SQL Injection in Beautiful Taxonomy Filters <= 2.4.6 versions.
Severity: 9.3 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-78289 - WordPress CozyStay theme <= 1.10.0 - Cross Site Scripting (XSS) vulnerability
CVE ID :CVE-2026-78289
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :Unauthenticated Cross Site Scripting (XSS) in CozyStay <= 1.10.0 versions.
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-78289
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :Unauthenticated Cross Site Scripting (XSS) in CozyStay <= 1.10.0 versions.
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-78292 - WordPress Hash Form plugin <= 1.4.1 - PHP Object Injection vulnerability
CVE ID :CVE-2026-78292
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :Unauthenticated PHP Object Injection in Hash Form <= 1.4.1 versions.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-78292
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :Unauthenticated PHP Object Injection in Hash Form <= 1.4.1 versions.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-78293 - WordPress WP w3all phpBB plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability
CVE ID :CVE-2026-78293
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :Unauthenticated Cross Site Scripting (XSS) in WP w3all phpBB <= 3.0.6 versions.
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-78293
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :Unauthenticated Cross Site Scripting (XSS) in WP w3all phpBB <= 3.0.6 versions.
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-80433 - WordPress SureFeedback Client Site plugin <= 1.2.12 - Sensitive Data Exposure vulnerability
CVE ID :CVE-2026-80433
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :Subscriber Sensitive Data Exposure in SureFeedback Client Site <= 1.2.12 versions.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-80433
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :Subscriber Sensitive Data Exposure in SureFeedback Client Site <= 1.2.12 versions.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-81271 - WordPress GeoDirectory plugin <= 2.8.176 - Cross Site Request Forgery (CSRF) vulnerability
CVE ID :CVE-2026-81271
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :Unauthenticated Cross Site Request Forgery (CSRF) in GeoDirectory <= 2.8.176 versions.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-81271
Published : Aug. 27, 2026, 10:16 a.m. | 1 hour, 26 minutes ago
Description :Unauthenticated Cross Site Request Forgery (CSRF) in GeoDirectory <= 2.8.176 versions.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...