Business and Enterprise Solutions

In Phoca Cart component for Joomla versions 6.1.6 and earlier a critical severity vulnerability CVE-2026-74251 was detected. This vulnerability allows an unauthenticated attacker to inject arbitrary SQL to extract the full database. To address this issue, users should upgrade Phoca Cart to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-74251.

In PPWP – Password Protect Pages component for WordPress versions 1.9.21 and earlier a medium severity vulnerability CVE-2026-3639 was detected. This vulnerability allows authenticated attackers to inject arbitrary web scripts in pages. To address this issue, users should upgrade PPWP – Password Protect Pages to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-3639.

In Ecwid by Lightspeed Ecommerce Shopping Cart component for WordPress versions before 7.0.9 a medium severity vulnerability CVE-2026-14332 was detected. This vulnerability allows any authenticated user to disconnect the store and take the storefront offline. To address this issue, users should upgrade Ecwid by Lightspeed Ecommerce Shopping Cart to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-14332.

In the Link Factory component for WordPress a critical severity vulnerability CVE-2026-15413 was detected. This vulnerability allows an attacker to gain unauthorized remote control over the website. To address this issue, users should upgrade Link Factory to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-15413.

In Cotton Cloud component for Joomla versions earlier than 2.0.3 a medium severity vulnerability CVE-2026-67284 was detected. This vulnerability allows authenticated users to perform unauthorized file operations on files owned by other users. To address this issue, users should upgrade Cotton Cloud to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-67284.

In Wallet System for WooCommerce component for WooCommerce versions before 2.7.10 a medium severity vulnerability CVE-2026-15045 was detected. This vulnerability allows authenticated customers to arbitrarily reduce their own order total without paying the merchant. To address this issue, users should upgrade Wallet System for WooCommerce to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-15045.

In Fabrik component for Joomla versions before 4.6.8 a critical severity vulnerability CVE-2026-67282 was detected. This vulnerability allows an unauthenticated attacker to execute arbitrary code. To address this issue, users should upgrade Fabrik to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-67282.

In Dolibarr versions up to 23.0.4 a medium severity vulnerability CVE-2026-77686 was detected. This vulnerability allows a remote attacker to bypass authorization checks, potentially leading to unauthorized access or modification of account details. This occurs due to an improper authorization flaw within the Account Handler component, specifically in the htdocs/user/card.php file. By manipulating the ID argument in the request, an attacker can access or alter resources belonging to other users. Warning: A public exploit for this vulnerability is available and could be used in active attacks. To address this issue, users should upgrade Dolibarr to version 24.0.0 or later, or apply the official patch (commit b2a2c995537cb6282383b5e903cb5ffa29b823e6). For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-77686.

In FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More component for WordPress versions 1.9.2 and earlier a high severity vulnerability CVE-2025-15028 was detected. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts in pages. To address this issue, users should upgrade FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-15028.