News & Sicurezza

CVE ID :CVE-2026-78333 Published : Aug. 27, 2026, 6:17 a.m. | 1 hour, 50 minutes ago Description :The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area page, leading to a Stored Cross-Site Scripting issue which could be used against high privilege users such as admin. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-78125 Published : Aug. 27, 2026, 6:17 a.m. | 1 hour, 50 minutes ago Description :The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthenticated attackers to disclose the payment status of arbitrary orders by enumerating order identifiers. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-78137 Published : Aug. 27, 2026, 6:17 a.m. | 1 hour, 50 minutes ago Description :The StoreGrowth WordPress plugin before 2.1.2 does not validate a browser-supplied product price on two of its unauthenticated actions, allowing unauthenticated attackers to add a product to the cart at an arbitrary, attacker-chosen price that carries through to the checkout total when the BOGO offer feature is enabled. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-77035 Published : Aug. 27, 2026, 6:17 a.m. | 1 hour, 50 minutes ago Description :Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager Severity: 5.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-77991 Published : Aug. 27, 2026, 6:17 a.m. | 1 hour, 50 minutes ago Description :Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager Severity: 9.4 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-77989 Published : Aug. 27, 2026, 6:17 a.m. | 1 hour, 50 minutes ago Description :Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-77990 Published : Aug. 27, 2026, 6:17 a.m. | 1 hour, 50 minutes ago Description :Joomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in Joomla Event Manager Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-77016 Published : Aug. 27, 2026, 6:17 a.m. | 1 hour, 51 minutes ago Description :The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate profile, and does not validate or contain the stored file path before deleting it, allowing users with a role as low as subscriber to delete arbitrary files on the server. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-77018 Published : Aug. 27, 2026, 6:17 a.m. | 1 hour, 51 minutes ago Description :The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload arbitrary files and achieve remote code execution. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-77017 Published : Aug. 27, 2026, 6:17 a.m. | 1 hour, 51 minutes ago Description :The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine the stored file location to an allowed directory before serving it, allowing users with a role as low as subscriber to read arbitrary files on the server, including its configuration file and authentication secrets. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-77034 Published : Aug. 27, 2026, 6:17 a.m. | 1 hour, 50 minutes ago Description :Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager Severity: 6.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-76549 Published : Aug. 27, 2026, 6:17 a.m. | 1 hour, 51 minutes ago Description :The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.7 does not have CSRF checks in one of its backup management actions, which could allow attackers to make a logged in admin restore an existing backup, reverting the site's database and files to an earlier state, via a crafted link. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...