CVE-2026-64796

Name of the Vulnerable Software and Affected Versions Sourcerer extension (affected versions not specified)

Description Multiple code injection vectors exist within the extension. The Free version fails to verify that both the article creator and the last modifier possess Super User privileges before executing PHP code within an article. The Pro version does not consistently enforce permissions for CSS, JavaScript, and PHP across tags, attributes, files, and article owners. Additionally, PHP include attributes may allow escaping the configured include folder, and certain executable script or style variants can bypass detection mechanisms.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.