Multiple CMS Plugin Vulnerabilities: WordPress CVEs and Joomla Novarain/Tassos Framework Flaws

Three newly described WordPress plugin vulnerabilities affect ShopLentor, Advanced AJAX Product Filters, and WP Maps. CVE-2026-1714 allows unauthenticated email relay abuse in ShopLentor (<= 3.3.2) via the woolentor_suggest_price_action AJAX endpoint due to missing validation of parameters such as send_to and product_title; the wlemail parameter can be abused for CRLF injection to control sender details, enabling spam/phishing relay through the victim site. CVE-2026-1426 is a PHP object injection issue in Advanced AJAX Product Filters (<= 3.1.9.6) reachable by authenticated users (Author+) through deserialization of untrusted input in shortcode_check within a Live Composer compatibility layer; impact depends on the presence of a usable POP chain in another installed plugin/theme and requires the Live Composer plugin to be installed and active. CVE-2025-12062 affects WP Maps (<= 4.8.6) and enables authenticated (Subscriber+) limited local file inclusion via fc_load_template, potentially leading to sensitive data exposure or code execution in scenarios where attacker-controlled .html content can be uploaded and then included.

Separately, Joomla sites using the Novarain/Tassos Framework (plg_system_nrframework) face critical issues enabling unauthenticated file read, file deletion, and SQL injection, which can be chained toward administrator takeover and potentially persistent RCE. The reported weaknesses stem from an AJAX handler that processes task=include without sufficient hardening, allowing attackers to reach internal classes implementing onAjax and abuse gadget-like behaviors (e.g., CSV loading for arbitrary file read, a remove action for path deletion, and attacker-influenced query construction for SQL injection). The risk propagates through multiple popular Tassos extensions that bundle the framework (including Convert Forms, EngageBox, Google Structured Data, Advanced Custom Fields, and Smile Pack), and remediation requires applying vendor updates for affected releases.