sign in--:--:--UTC

CVE-2026-48907

exploited in the wild

CVSS

10.0

Reports

3

First seen

Jun 16

Last seen

Jun 17

Affected product

Widget Factory Joomla Content Editor (JCE) plugin

Associated actors

Unknown (Turkish-speaking SEO monetization group) ×1

Recent reports

CISA orders feds to patch max severity Joomla JCE plugin flaw by Friday

Bleeping ComputerJun 17 Critical

CISA Warns of Actively Exploited Joomla JCE Flaw Allowing PHP Code Execution

The Hacker NewsJun 17 High

CISA Adds Widget Factory Joomla Vulnerability to Known Exploited Vulnerabilities Catalog

CISA AdvisoriesJun 16

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign up See plans