Signalis
sign in--:--:--UTC
CVEs

CVE-2026-48907

exploited in the wild☆ pin
CVSS
10.0
Reports
5
First seen
Jun 16, 2026
Last seen
Jul 13, 2026
Affected product

Widget Factory Joomla Content Editor (JCE) plugin

Associated actors

Unknown (Turkish-speaking SEO monetization group) ×1WP-SHELLSTORM ×1

Recent reports

Critical

iCagenda and Balbooa Forms Joomla Flaws Exploited as Zero-Days; Global CMS Campaign Ongoing

The Hacker NewsHigh

WP-SHELLSTORM: Exposed Server Reveals Webshell Backdooring Operation Targeting 1.4M Sites

The Hacker NewsCritical

CISA orders feds to patch max severity Joomla JCE plugin flaw by Friday

Bleeping ComputerCritical

CISA Warns of Actively Exploited Joomla JCE Flaw Allowing PHP Code Execution

The Hacker NewsHigh

CISA Adds Widget Factory Joomla Vulnerability to Known Exploited Vulnerabilities Catalog

CISA Advisories

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign upSee plans