19613 matches found
CVE-2026-66682 WordPress Abandoned Cart Pro for WooCommerce plugin <= 10.4.0 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Abandoned Cart Pro for WooCommerce = 10.4.0 versions...
CVE-2026-66611 WordPress Paymob for WooCommerce plugin <= 4.1.10 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Paymob for WooCommerce = 4.1.10 versions...
EUVD-2026-63296
Unauthenticated Cross Site Scripting XSS in Paymob for WooCommerce = 4.1.10 versions...
CVE-2026-66611
CVE-2026-66611 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the Paymob for WooCommerce WordPress plugin, affecting versions ≤ 4.1.10 . The flaw was discovered by dutafi and rated CVSS 7.1 (HIGH) with a changed scope, indicating an attacker can execute scripts in a different s...
EUVD-2026-63294
Unauthenticated Cross Site Scripting XSS in Advance Product Search = 1.4.8 versions...
CVE-2026-66605 WordPress Swatchly – WooCommerce Variation Swatches for Products plugin <= 1.4.13 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Swatchly – WooCommerce Variation Swatches for Products = 1.4.13 versions...
EUVD-2026-63344
Unauthenticated Cross Site Scripting XSS in Swatchly – WooCommerce Variation Swatches for Products = 1.4.13 versions...
CVE-2026-66605
CVE-2026-66605 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the Swatchly – WooCommerce Variation Swatches for Products WordPress plugin, affecting versions
WordPress Cancel Order & Request Woocommerce plugin < 1.3.4.34 - Unauthenticated Order Content Disclosure via Reorder AJAX Actions vulnerability
Unauthenticated Order Content Disclosure via Reorder AJAX Actions vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Cancel order request WooCommerce versions 1.3.4.34...
PT-2026-78992
Name of the Vulnerable Software and Affected Versions EPROLO Dropshipping versions prior to 2.4.3 Description Broken access control allows unauthenticated users to gain unauthorized access to restricted areas or functions of the system. Recommendations Update to a version newer than 2.4.2...
PT-2026-78980
Name of the Vulnerable Software and Affected Versions Abandoned Cart Pro for WooCommerce versions prior to 10.4.1 Description An issue allows unauthenticated users to perform privilege escalation. Recommendations Update Abandoned Cart Pro for WooCommerce to version 10.4.1 or later...
CVE-2026-73363
Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce 2.0.8 versions...
CVE-2026-32552
Subscriber SQL Injection in YITH WooCommerce Membership Premium = 2.33.0 versions...
CVE-2026-73389
CVE-2026-73389 is an unauthenticated PHP Object Injection vulnerability in the Kalles Addons WordPress plugin, affecting versions 1.0.6 and earlier . The flaw allows a remote, unauthenticated attacker to achieve full compromise of confidentiality, integrity, and availability, reflected in a CVSS ...
CVE-2026-73363 WordPress Taxi Booking Manager for WooCommerce plugin < 2.0.8 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce 2.0.8 versions...
CVE-2026-73363
CVE-2026-73363 is an unauthenticated Broken Access Control vulnerability in the WordPress plugin Taxi Booking Manager for WooCommerce (plugin slug: ecab-taxi-booking-manager ), affecting versions prior to 2.0.8 . The flaw allows a low-privileged user to perform unauthorized actions, resulting in ...
CVE-2026-73364
WordPress Flexible Subscriptions plugin (versions ≤ 1.8.1) is vulnerable to PHP Object Injection, allowing unauthenticated remote attackers to execute arbitrary code and achieve full system compromise (CVSS 9.8 Critical). Patchstack reference: https://patchstack.com/database/wordpress/plugin/flex...
EUVD-2026-62383
Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce 2.0.8 versions...
CVE-2026-32552
A SQL Injection vulnerability exists in the YITH WooCommerce Membership Premium WordPress plugin, affecting versions 2.33.0 and earlier . The flaw is in the Subscriber functionality and was discovered by dutafi . The CVSS 3.1 score is 8.5 (HIGH) , with a network attack vector, low complexity, and...