Vendor
The Joomla UP plugin (Universal Plugin) is vulnerable to unauthenticated remote code execution via insecure GitHub action installation (CVE-2026-97163), allowing attackers to force the download of arbitrary code due to disabled TLS certificate verification.