CVE-2026-17581

The CVE concerns the WCPOS – Point of Sale (POS) plugin for WooCommerce (WordPress). Affected versions: up to 1.9.14. Root cause: the Receipt_Renderer_Factory dispatches templates using the thermal engine to the Legacy_Php_Renderer instead of a safe thermal-specific renderer, enabling Code Inject...