CVE-2026-103376: Exposure of Sensitive Information to an Unauthorized Actor

The PeachPay — Payments & Express Checkout for WooCommerce supports Stripe, PayPal, Square, Authorize.net, NMI WordPress plugin before 1.120.70 does not perform any capability or ownership check before returning an order's secret key in response to an unauthenticated request, allowing anyone to...

CVE-2026-111602: Exposure of Sensitive Information to an Unauthorized Actor

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.4 via the 'params customeruuid' parameter. This makes it possible for unauthenticated attackers to extrac...

CVE-2026-109208: Improper Neutralization of Input During Web Page Generation

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'quantity REST / ordercomments checkout' parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output...

CVE-2026-104736: Deserialization of Untrusted Data

The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The value is passed through sanitizetextfield, which does not stri...

PT-2026-116199

Name of the Vulnerable Software and Affected Versions LearnPress versions prior to 4.4.11 Description Insufficient input sanitization and output escaping allow for Stored Cross-Site Scripting. This occurs via the quantity parameter in the REST API and the order comments parameter during checkout...

PT-2026-116352

Name of the Vulnerable Software and Affected Versions LearnPress versions prior to 4.4.11 Description An unauthenticated attacker can perform PHP Object Injection by sending untrusted input through the checkout-email request parameter during the checkout AJAX action. The input is processed by...

PT-2026-116202

Name of the Vulnerable Software and Affected Versions LatePoint versions prior to 5.7.5 Description An issue exists that allows unauthenticated attackers to extract sensitive customer data, including first name, last name, email address, phone number, and notes, from the database. This is achieve...

WordPress European VAT Compliance Assistant for WooCommerce Cross-site Script Vulnerabilities

The WordPress European VAT Compliance Assistant for WooCommerce version 1.36.10 and earlier has a cross-site scripting vulnerability. This vulnerability stems from improper input cleaning and insufficient output escaping. Unauthenticated attackers can inject arbitrary web scripts through the...

ThimPress LearnPress deserialization injection vulnerability

ThimPress and LearnPress versions 4.4.10 and earlier have a deserialization injection vulnerability. This vulnerability stems from improper deserialization handling of the 'checkout-email' request parameter during the checkout AJAX operation. The deserialization process does not filter the syntax...

CVE-2026-110804

Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to delete arbitrary Active Directory groups or retain elevated privileges via client-supplied JIT elevation settings in a...

CVE-2026-110804

Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to delete arbitrary Active Directory groups or retain elevated privileges via client-supplied JIT elevation settings in a...

CVE-2026-110804

The Devolutions Server version 2026.3.8.0 and earlier is vulnerable to an improper modification of JIT elevation settings within the PAM checkout component. This flaw allows an authenticated user with PAM checkout access to either delete arbitrary Active Directory groups or retain elevated privil...

CVE-2026-110804

Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to delete arbitrary Active Directory groups or retain elevated privileges via client-supplied JIT elevation settings in a...

EUVD-2026-102876

Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to delete arbitrary Active Directory groups or retain elevated privileges via client-supplied JIT elevation settings in a...

CVE-2026-111409

Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce yith-paypal-express-checkout-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.61.0...

EUVD-2026-102865

Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce yith-paypal-express-checkout-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.61.0...

CVE-2026-111409 WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.61.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce yith-paypal-express-checkout-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.61.0...

CVE-2026-111409

The YITH PayPal Express Checkout for WooCommerce plugin (versions

CVE-2026-111409 WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.61.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce yith-paypal-express-checkout-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.61.0...

WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.61.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Oly Hossen in WordPress Plugin YITH PayPal Express Checkout for WooCommerce versions = 1.61.0...