19659 matches found
CVE-2026-19089-WooCommerce-Tyche
CVE-2026-19089 — WooCommerce Tyche Product Input Fields Status: incomplete / work in progress. This repository is a stub. The script is not a finished PoC, is not packaged for use, and should not be treated as a complete or reliable demonstration. Abraxas Labs research notes for CVE-2026-19089 al...
woocommerce-plugin-supply-chain-security-assessment
CVE-2026-49777 - Implantation de logiciel malveillant RCE dans WooCommerce Product Slider Pro Rapport de cybersécurité de style consultant Rapport professionnel d'évaluation de vulnérabilité pour le risque lié à la chaîne d'approvisionnement du plugin WooCommerce, incluant l'impact commercial, la...
CVE-2024-54262
CVE-2024-54262 Explotación de CVE-2024-54262: Carga arbitraria de archivos en Import Export para WooCommerce Resumen Este script explota una vulnerabilidad en el plugin "Import Export for WooCommerce" de WordPress. La vulnerabilidad permite a usuarios no autorizados subir archivos arbitrarios, lo...
CVE-2026-87860
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making...
CVE-2026-87854
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing unauthenticated users to retrieve the store's full list of subscriptions, including customer usernames, product names, recurring amounts and...
CVE-2026-78474
The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not have any authentication or authorisation checks on one of its report-printing routines, allowing unauthenticated users to retrieve WooCommerce order details and customer contact information, to target an individual order, and ...
CVE-2026-78472
The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks...
CVE-2026-87854
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints , enabling unauthenticated users to retrieve the store's full subscription list, including customer usernames, product names, recurring amounts, and p...
EUVD-2026-80209
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making...
CVE-2026-87860 Subscriptions for WooCommerce < 2.0.3 - Subscription Cancellation via CSRF
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making...
CVE-2026-87854 Subscriptions for WooCommerce < 2.0.3 - Unauthenticated Subscription Data Disclosure via REST API Secret Key Bypass
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing unauthenticated users to retrieve the store's full list of subscriptions, including customer usernames, product names, recurring amounts and...
CVE-2026-87860
CVE-2026-87860 affects the Subscriptions for WooCommerce WordPress plugin in versions before 2.0.3 . The plugin does not verify the security token on the request that cancels a subscription, resulting in a CSRF flaw. An attacker can craft a request that tricks a logged-in customer into cancelling...
WordPress Subscriptions for WooCommerce plugin < 2.0.3 - Subscription Cancellation vulnerability
Subscription Cancellation vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Subscriptions for WooCommerce versions 2.0.3...
EUVD-2026-80208
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing unauthenticated users to retrieve the store's full list of subscriptions, including customer usernames, product names, recurring amounts and...
WordPress Subscriptions for WooCommerce plugin < 2.0.3 - Unauthenticated Subscription Data Disclosure vulnerability
Unauthenticated Subscription Data Disclosure vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Subscriptions for WooCommerce versions 2.0.3...
EUVD-2026-80186
The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not have any authentication or authorisation checks on one of its report-printing routines, allowing unauthenticated users to retrieve WooCommerce order details and customer contact information, to target an individual order, and ...
CVE-2026-78474 Ni WooCommerce Sales Report < 4.2.0 - Unauthenticated Order and Customer Data Disclosure via 'btn_print' Parameter
The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not have any authentication or authorisation checks on one of its report-printing routines, allowing unauthenticated users to retrieve WooCommerce order details and customer contact information, to target an individual order, and ...
CVE-2026-78472
The Ni WooCommerce Sales Report WordPress plugin (versions before 4.2.0 ) contains an unauthenticated SQL injection vulnerability caused by a failure to sanitise and escape the sort parameter before use in a SQL statement. Discovered by Erwan LR (WPScan) via Patchstack, this allows remote attacke...
CVE-2026-78474
The Ni WooCommerce Sales Report WordPress plugin (versions before 4.2.0 ) lacks authentication and authorisation checks on a report-printing routine accessible via the btn_print parameter. This allows unauthenticated users to retrieve WooCommerce order details and customer contact information , t...
CVE-2026-78472 Ni WooCommerce Sales Report < 4.2.0 - Unauthenticated SQLi via 'sort' Parameter
The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks...