MIDOSSA Technical Support

Latest Vulnerabilities

Live defensive vulnerability intelligence for WordPress, Joomla and PrestaShop with severity, affected versions, fixes and official sources.

Request Technical Support WhatsApp MIDOSSA
Start with the symptom.

Send us the website URL, the exact error if available and a short description of what changed.

Latest WordPress, Joomla & PrestaShop Vulnerabilities

Follow recent public security advisories relevant to the CMS platforms and hosting environments MIDOSSA supports. This page is built for defensive awareness: affected software, severity, published date, fixed versions when available and the official advisory source.

Defensive intelligence only

No exploit payloads or attack instructions are published here. Always verify the official advisory before making production changes.

Live security feed

Latest Vulnerabilities

Last synchronized: October 27, 2026 10:48 am

Source titles are kept in their original language to preserve technical accuracy.

WordPress Medium

enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision

CVE-2026-107380 Published 2026-10-08

Package: enshrined/svg-sanitize

Affected: <= 0.22.0

Fixed: 1.0.0

Source: GitHub Advisory DatabaseView official advisory →
WordPress Medium

enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash

CVE-2026-107379 Published 2026-10-08

Package: enshrined/svg-sanitize

Affected: <= 0.22.0

Fixed: 1.0.0

Source: GitHub Advisory DatabaseView official advisory →
Joomla Medium

[20260916] - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs

CVE-2026-92232 Published 2026-09-25

Package: Joomla CMS

Affected:  1.5.0-5.4.8,6.0.0-6.1.3

Fixed: Upgrade to version 5.4.9, 6.1.4

Source: Joomla Security CentreView official advisory →
Joomla Medium

[20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch

CVE-2026-92231 Published 2026-09-25

Package: Joomla CMS

Affected:  1.5.0-5.4.8,6.0.0-6.1.3

Fixed: Upgrade to version 5.4.9, 6.1.4

Source: Joomla Security CentreView official advisory →
Joomla Medium

[20260914] - Core - MFA Authentication Bypass through rememberme cookies

CVE-2026-92227 Published 2026-09-25

Package: Joomla CMS

Affected:  4.0.0-5.4.8,6.0.0-6.1.3

Fixed: Upgrade to version 5.4.9, 6.1.4

Source: Joomla Security CentreView official advisory →
Joomla Medium

[20260913] - Core - Improper ACL checks for varous webservice edit tasks

CVE-2026-92226 Published 2026-09-25

Package: Joomla CMS

Affected:  4.0.0-5.4.8,6.0.0-6.1.3

Fixed: Upgrade to version 5.4.9, 6.1.4

Source: Joomla Security CentreView official advisory →
Joomla Medium

[20260912] - Core - XSS in module list

CVE-2026-92225 Published 2026-09-25

Package: Joomla CMS

Affected:  4.0.0-5.4.8,6.0.0-6.1.3

Fixed: Upgrade to version 5.4.9, 6.1.4

Source: Joomla Security CentreView official advisory →
Joomla Medium

[20260910] - Core - Improper ACL checks for workflow stage changes

CVE-2026-92223 Published 2026-09-25

Package: Joomla CMS

Affected:  5.0.0-5.4.8,6.0.0-6.1.3

Fixed: Upgrade to version 5.4.9, 6.1.4

Source: Joomla Security CentreView official advisory →
Joomla High

[20260909] - Core - SSRF vectors in various core extensions

CVE-2026-92222 Published 2026-09-25

Package: Joomla CMS

Affected:  3.0.0-5.4.8,6.0.0-6.1.3

Fixed: Upgrade to version 5.4.9, 6.1.4

Source: Joomla Security CentreView official advisory →
Joomla Medium

[20260911] - Core - XSS in link toolbar layout

CVE-2026-92224 Published 2026-09-25

Package: Joomla CMS

Affected:  4.0.0-5.4.8,6.0.0-6.1.3

Fixed: Upgrade to version 5.4.9, 6.1.4

Source: Joomla Security CentreView official advisory →
Joomla Medium

[20260908] - Core - XSS in HTML Mail Templates

CVE-2026-90918 Published 2026-09-25

Package: Joomla CMS

Affected:  4.0.0-5.4.8,6.0.0-6.1.3

Fixed: Upgrade to version 5.4.9, 6.1.4

Source: Joomla Security CentreView official advisory →
Joomla Medium

[20260907] - Core - Improper ACL checks in outputs for tagged items

CVE-2026-90917 Published 2026-09-25

Package: Joomla CMS

Affected:  4.0.0-5.4.8,6.0.0-6.1.3

Fixed: Upgrade to version 5.4.9, 6.1.4

Source: Joomla Security CentreView official advisory →
Joomla Low

[20260906] - Core - Improper ACL checks in content history comparison view

CVE-2026-90916 Published 2026-09-25

Package: Joomla CMS

Affected:  4.0.0-5.4.8,6.0.0-6.1.3

Fixed: Upgrade to version 5.4.9, 6.1.4

Source: Joomla Security CentreView official advisory →
Joomla High

[20260905] - Core - Arbitrary directory deletion via cache purge action

CVE-2026-90915 Published 2026-09-25

Package: Joomla CMS

Affected:  4.0.0-5.4.8,6.0.0-6.1.3

Fixed: Upgrade to version 5.4.9, 6.1.4

Source: Joomla Security CentreView official advisory →
Joomla Medium

[20260904] - Core - XSS in the generic media output layouts

CVE-2026-90914 Published 2026-09-25

Package: Joomla CMS

Affected:  4.0.0-5.4.8,6.0.0-6.1.3

Fixed: Upgrade to version 5.4.9, 6.1.4

Source: Joomla Security CentreView official advisory →
Joomla Medium

[20260903] - Core - Improper ACL checks for access level webservice endpoints

CVE-2026-90913 Published 2026-09-25

Package: Joomla CMS

Affected:  4.0.0-5.4.8,6.0.0-6.1.3

Fixed: Upgrade to version 5.4.9, 6.1.4

Source: Joomla Security CentreView official advisory →
Joomla Medium

[20260902] - Core - Unauthorized user account creation via profile.save controller

CVE-2026-90907 Published 2026-09-25

Package: Joomla CMS

Affected:  1.5.0-5.4.8,6.0.0-6.1.3

Fixed: Upgrade to version 5.4.9, 6.1.4

Source: Joomla Security CentreView official advisory →
Joomla Medium

[20260901] - Core - XSS in HTMLHelper::link method

CVE-2026-90906 Published 2026-09-25

Package: Joomla CMS

Affected:  1.5.0-5.4.8,6.0.0-6.1.3

Fixed: Upgrade to version 5.4.9, 6.1.4

Source: Joomla Security CentreView official advisory →
WordPress Medium

WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost

CVE-2026-88974 Published 2026-09-23

Package: wp-graphql/wp-graphql

Affected: < 2.22.2

Source: GitHub Advisory DatabaseView official advisory →
Joomla Low

[20260810] - Core - Unrestricted uploads of SHTML files

CVE-2026-73373 Published 2026-08-17

Package: Joomla CMS

Affected:  1.0.0-5.4.7,6.0.0-6.1.2

Fixed: Upgrade to version 5.4.8, 6.1.3

Source: Joomla Security CentreView official advisory →
Joomla Low

[20260809] - Core - Improper ACL checks when injection schema.org contact data

CVE-2026-73372 Published 2026-08-17

Package: Joomla CMS

Affected:  5.1.0-5.4.7,6.0.0-6.1.2

Fixed: Upgrade to version 5.4.8, 6.1.3

Source: Joomla Security CentreView official advisory →
Joomla Low

[20260808] - Core - Improper ACL checks for batch copy actions

CVE-2026-73371 Published 2026-08-17

Package: Joomla CMS

Affected:  4.0.0-5.4.7,6.0.0-6.1.2

Fixed: Upgrade to version 5.4.8, 6.1.3

Source: Joomla Security CentreView official advisory →
Joomla Medium

[20260807] - Core - MFA Authentication Bypass

CVE-2026-73337 Published 2026-08-17

Package: Joomla CMS

Affected:  4.0.0-5.4.7,6.0.0-6.1.2

Fixed: Upgrade to version 5.4.8, 6.1.3

Source: Joomla Security CentreView official advisory →
Joomla Medium

[20260806] - Core - XSS through schema.org outputs

CVE-2026-73336 Published 2026-08-17

Package: Joomla CMS

Affected:  5.1.0-5.4.7, 6.0.0-6.1.2

Fixed: Upgrade to version 5.4.8, 6.1.3

Source: Joomla Security CentreView official advisory →
Joomla Medium

[20260805] - Core - Improper ACL checks for category webservice endpoints

CVE-2026-72532 Published 2026-08-17

Package: Joomla CMS

Affected:  4.0.0-5.4.7, 6.0.0-6.1.2

Fixed: Upgrade to version 5.4.8, 6.1.3

Source: Joomla Security CentreView official advisory →
Joomla Medium

[20260804] - Core - Improper ACL checks for custom fields webservice endpoints

CVE-2026-72531 Published 2026-08-17

Package: Joomla CMS

Affected:  4.0.0-5.4.7, 6.0.0-6.1.2

Fixed: Upgrade to version 5.4.8, 6.1.3

Source: Joomla Security CentreView official advisory →
Joomla Medium

[20260803] - Core - Inconsistent ACL checks for mutating webservice endpoints

CVE-2026-71574 Published 2026-08-17

Package: Joomla CMS

Affected:  4.0.0-5.4.7, 6.0.0-6.1.2

Fixed: Upgrade to version 5.4.8, 6.1.3

Source: Joomla Security CentreView official advisory →
Joomla Medium

[20260802] - Core - Improper CORS origin validation

CVE-2026-71573 Published 2026-08-17

Package: Joomla CMS

Affected:  4.0.0-5.4.7, 6.0.0-6.1.2

Fixed: Upgrade to version 5.4.8, 6.1.3

Source: Joomla Security CentreView official advisory →
Security Assessment

Is my website affected?

Security Assessment

How to use this vulnerability feed

1. Identify your platform

Filter WordPress, Joomla or PrestaShop and search for a product, package or CVE identifier.

2. Check affected versions

Compare the advisory with the CMS, plugin, extension, module or package version running on your website.

3. Patch and verify

Use the vendor’s official remediation guidance, create a recoverable backup and test important functionality after updates.

Authoritative sources & refresh

The live feed uses public defensive advisories from the GitHub Advisory Database and the Joomla Security Centre. Results are refreshed automatically and cached briefly to protect source services and keep this page fast. Coverage is informational and is not guaranteed to include every vulnerability affecting every plugin, extension or module.

Not sure whether your website is affected?

Send us your website URL, CMS and version information. MIDOSSA can perform a deeper security assessment and recommend the safest remediation path.

Request Technical Support

WhatsApp Support