CVE-2025-48123

CVE-2025-48123 is a confirmed Remote Code Execution (RCE) vulnerability in the WordPress plugin Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light (Holest Engineering)

CVE-2025-48129 WordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light <= 2.4.37 - Privilege Escalation Vulnerability

Incorrect Privilege Assignment vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light allows Privilege Escalation. This issue affects Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: from n/a through 2.4.37...

CVE-2025-48129

The CVE-2025-48129 issue affects the WordPress plugin Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light, with vulnerable versions up to 2.4.37. The root cause is an Incorrect Privilege Assignment that enables Privilege Escalation (e.g., unauthorized admin-level access). Public m...

WordPress plugin Welcart e-Commerce has a path traversal vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A path traversal...

Vigybag security vulnerabilities

Vigybag is an e-commerce platform by Vigybag India. A security vulnerability exists in Vigybag v1.0 and earlier versions, which stems from the Upload Profile Image feature in My Profile being vulnerable to cross-site scripting attacks...

CVE-2025-48123: Improper Control of Generation of Code

Improper Control of Generation of Code 'Code Injection' vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light excel-like-price-change-for-woocommerce-and-wp-e-commerce-light allows Code Injection.This issue affects Spreadsheet Price Changer for...

CVE-2025-48129: Incorrect Privilege Assignment

Incorrect Privilege Assignment vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light excel-like-price-change-for-woocommerce-and-wp-e-commerce-light allows Privilege Escalation.This issue affects Spreadsheet Price Changer for WooCommerce and WP...

CVE-2025-47511: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Path Traversal.This issue affects Welcart e-Commerce: from n/a through = 2.11.13...

PT-2025-24513 · Unknown · Spreadsheet Price Changer For Woocommerce/Wp E-Commerce – Light

Name of the Vulnerable Software and Affected Versions: Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light versions 2.4.37 and earlier Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal'. This allows a...

WordPress plugin "Spreadsheet Price Changer" for WooCommerce and WP E-commerce – Light path traversal vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin Spreadsheet Price...

CVE-2025-48124: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light excel-like-price-change-for-woocommerce-and-wp-e-commerce-light allows Path Traversal.This issue affects Spreadsheet...

PT-2025-24505 · Unknown · Welcart E-Commerce

Name of the Vulnerable Software and Affected Versions: Welcart e-Commerce versions 2.11.13 and earlier Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal'. This allows for Path Traversal in nanbu Welcart e-Commerce...

CVE-2025-48122: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light excel-like-price-change-for-woocommerce-and-wp-e-commerce-light allows SQL Injection.This issue affects...

WordPress Plugin: Spreadsheet Price Changer for WooCommerce and WP E-commerce – Vulnerability Due to Light SQL Injection

WordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce - Light is a plugin for WordPress that makes it easy to change prices for WooCommerce and WP e-commerce products. WordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce - Light is vulnerable to SQL injection. The...

VulnCheck KEV: CVE-2024-46938

An issue was discovered in Sitecore Experience Platform XP, Experience Manager XM, and Experience Commerce XC 8.0 Initial Release through 10.4 Initial Release. An unauthenticated attacker can read arbitrary files...

WordPress Welcart e-Commerce plugin <= 2.11.13 - Arbitrary File Deletion Vulnerability

Arbitrary File Deletion Vulnerability discovered by astra.r3verii in WordPress Plugin Welcart e-Commerce versions = 2.11.13...

Uncovering Black-Hat SEO Based Fake E-Commerce Scam Groups from Their Redirectors and Websites

While law enforcements agencies and cybercrime researchers are working hard, fake E-commerce scam is still a big threat to Internet users. One of the major techniques to victimize users is luring them by black-hat search-engine-optimization SEO; making search engines display their lure pages as i...

CVE-2025-22339

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in athemeart Store Commerce store-commerce allows DOM-Based XSS.This issue affects Store Commerce: from n/a through = 1.2.3...

CVE-2025-22384

An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue concerning business logic exists in the Commerce B2B application, which allows storefront visitors to purchase discontinued products in specific scenarios where requests are altered before reaching...

CVE-2025-22385

An issue was discovered in Optimizely Configured Commerce before 5.2.2408. For newly created accounts, the Commerce B2B application does not require email confirmation. This medium-severity issue allows the mass creation of accounts. This could affect database storage; also, non-requested...