5040 matches found
PT-2026-65784
The Extra Checkout Options addon for Extra Product Options & Add-Ons for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.3.2. This is due to missing authorization and nonce validation in the eco save settings function, which allows...
CVE-2026-41874
Quick.Cart stores hard-coded, plaintext admin credentials in a configuration file. This flaw allows attackers with access to the server file system to retrieve authentication details, potentially leading to privilege escalation. The vendor assessed the likelihood of exploitation as very low and...
CVE-2026-41874
Quick.Cart stores hard-coded, plaintext admin credentials in a configuration file. This flaw allows attackers with access to the server file system to retrieve authentication details, potentially leading to privilege escalation. The vendor assessed the likelihood of exploitation as very low and...
CVE-2026-41874
CVE-2026-41874 affects Quick.Cart; hard-coded, plaintext admin credentials stored in a configuration file allow local access to credentials when an attacker can access the server filesystem, potentially enabling privilege escalation. Only version 6.7 was tested; all versions are considered vulner...
CVE-2026-12800
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter of the POST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint in versions up to, and including, 6.2.0. This is due to insufficient escaping on the user-supplied...
EUVD-2026-49723
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter of the POST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint in versions up to, and including, 6.2.0. This is due to insufficient escaping on the user-supplied...
CVE-2026-12800 Premium Packages <= 6.2.0 - Unauthenticated SQL Injection
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter of the POST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint in versions up to, and including, 6.2.0. This is due to insufficient escaping on the user-supplied...
CVE-2026-12800
The CVE-2026-12800 affects the Premium Packages – Sell Digital Products Securely plugin for WordPress (versions up to 6.2.0). A SQL Injection exists via the code parameter in the POST /wp-json/wpdmpp/v1/cart/coupon REST endpoint. Root cause: user-supplied code is interpolated directly into a raw ...
PT-2026-65412
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter of the POST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint in versions up to, and including, 6.2.0. This is due to insufficient escaping on the user-supplied...
CVE-2026-65557
Shop manager Cross Site Scripting XSS in Abandoned Cart Lite for WooCommerce = 6.8.0 versions...
EUVD-2026-49232
Shop manager Cross Site Scripting XSS in Abandoned Cart Lite for WooCommerce = 6.8.0 versions...
CVE-2026-65557
Shop manager Cross Site Scripting XSS in Abandoned Cart Lite for WooCommerce = 6.8.0 versions...
CVE-2026-65557
CVE-2026-65557 concerns the WordPress plugin Abandoned Cart Lite for WooCommerce (versions <= 6.8.0), where a Cross Site Scripting (XSS) flaw affects the shop-manager context. The connected records confirm the affected product (WordPress WooCommerce plugin), the vulnerability type (XSS), and t...
CVE-2026-65557 WordPress Abandoned Cart Lite for WooCommerce plugin <= 6.8.0 - Cross Site Scripting (XSS) vulnerability
Shop manager Cross Site Scripting XSS in Abandoned Cart Lite for WooCommerce = 6.8.0 versions...
WordPress Abandoned Cart Lite for WooCommerce plugin <= 6.8.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Abandoned Cart Lite for WooCommerce versions = 6.8.0...
CVE-2026-57703
CVE-2026-57703 affects WordPress Sunshine Photo Cart plugin versions
EUVD-2026-48174
Subscriber Broken Access Control in Sunshine Photo Cart = 3.6.10.1 versions...
CVE-2026-9713
The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' and 'table' parameters in the uploaded cart JSON file processed by the checkout AJAX action in versions up to, and including, 2.1.1. This is due to insufficient escaping on the user-suppli...
CVE-2026-9713
The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' and 'table' parameters in the uploaded cart JSON file processed by the checkout AJAX action in versions up to, and including, 2.1.1. This is due to insufficient escaping on the user-suppli...
CVE-2026-9713
CVE-2026-9713 : The Lumise Product Designer for WooCommerce WordPress plugin (up to version 2.1.1) is vulnerable to SQL injection via the uploaded cart JSON file processed by the checkout AJAX action. The root cause is insufficient escaping of user-provided parameters in the find_resource() funct...