Business and Enterprise Solutions

In F4 Post Tree component for WordPress versions before 2.0.5 a medium severity vulnerability CVE-2026-9676 was detected. This vulnerability allows authenticated users with Subscriber-level access and above to modify the parent and menu order of arbitrary posts. To address this issue, users should upgrade F4 Post Tree to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-9676.

In Helix3 plugin component for Joomla in unpatched versions a high severity vulnerability CVE-2026-49049 was detected. This vulnerability allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files and update template parameters. To address this issue, users should upgrade Helix3 plugin to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-49049.

In Page Builder CK component for Joomla versions before 3.6.0 a critical severity vulnerability CVE-2026-56290 was detected. This vulnerability allows attackers to upload arbitrary files and achieve remote code execution. To address this issue, users should upgrade Page Builder CK to version 3.6.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-56290.

In WooCommerce Designer Pro component for WooCommerce versions 1.9.34 and earlier a medium severity vulnerability CVE-2026-57329 was detected. This vulnerability allows attackers to execute arbitrary web scripts. To address this issue, users should upgrade WooCommerce Designer Pro to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-57329.

In Splash – Sport Club WordPress Theme for Basketball, Football, Hockey component for WordPress versions 4.4.3 and earlier a high severity vulnerability CVE-2025-68063 was detected. This vulnerability allows an attacker to include and execute arbitrary files on the server. To address this issue, users should upgrade Splash – Sport Club WordPress Theme for Basketball, Football, Hockey to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-68063.

In MapPress Maps for WordPress component for WordPress versions 2.97.3 and earlier a high severity vulnerability CVE-2026-56011 was detected. This vulnerability allows attackers to inject malicious scripts. To address this issue, users should upgrade MapPress Maps for WordPress to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-56011.

In Abandoned Cart Pro for WooCommerce component for WooCommerce versions 10.4.0 and earlier a high severity vulnerability CVE-2026-56010 was detected. This vulnerability allows attackers to escalate their privileges. To address this issue, users should upgrade Abandoned Cart Pro for WooCommerce to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-56010.

In AdRotate Banner Manager plugin for WordPress versions up to and including 5.17.7 a high severity vulnerability CVE-2026-12242 was detected. This vulnerability allows authenticated attackers with at least Contributor-level access to execute arbitrary PHP code. There’s no fix available for this issue at the moment. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-12242.

In Dolibarr ERP & CRM versions up to and including 21.0.1 a high severity vulnerability CVE-2025-56588 was detected. This vulnerability allows an authenticated attacker to execute arbitrary code on the underlying server, leading to Remote Code Execution (RCE). This occurs due to insecure processing of the computed field parameter within the User module configuration. By injecting malicious payloads into this configuration field, an attacker can bypass intended restrictions and run arbitrary system commands. To address this issue, users should upgrade Dolibarr ERP & CRM to a patched version version 21.0.3 or higher. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-56588.