CVE-2026-97471

The Avada Fusion Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.16.1 via the 'argslinktarget' parameter. This makes it possible for unauthenticated attackers to extract arbitrary user meta values for any user ID, including...

EUVD-2026-100799

The Avada Fusion Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.16.1 via the 'argslinktarget' parameter. This makes it possible for unauthenticated attackers to extract arbitrary user meta values for any user ID, including...

CVE-2026-94375

The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8 via the getfilepath. This makes it possible for unauthenticated attackers to extract download exported order CSV files containing custom...

CVE-2026-94375

The Order Export & Order Import for WooCommerce plugin for WordPress (versions

CVE-2026-94375 Order Export & Order Import for WooCommerce <= 2.7.8 - Unauthenticated Sensitive File Exposure via Missing Directory Guard Re-verification in get_file_path()

The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8 via the getfilepath. This makes it possible for unauthenticated attackers to extract download exported order CSV files containing custom...

EUVD-2026-96098

The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8 via the getfilepath. This makes it possible for unauthenticated attackers to extract download exported order CSV files containing custom...

CVE-2026-105198 LatePoint < 5.7.3 - Unauthenticated Customer PII Disclosure via IDOR

The Appointment Booking Plugin WordPress plugin before 5.7.3 does not verify that the caller owns the order referenced by an order-item identifier before rendering that order's confirmation summary, letting an unauthenticated visitor retrieve any customer's name, contact details and order...

CVE-2026-17538 Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification

The LatePoint - Appointment Booking & Reservation plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.6.9. This is due to the processstepcustomer function using isuserloggedin as the sole gate before merging POSTed customer data into an...

CVE-2026-17538

The LatePoint - Appointment Booking & Reservation plugin for WordPress (versions

CVE-2026-92245

The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.12.32 via the 'recursive' parameter. This makes it possible for unauthenticated attackers to extract customer PII — including names, email addresses, pho...

EUVD-2026-90464

The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.12.32 via the 'recursive' parameter. This makes it possible for unauthenticated attackers to extract customer PII — including names, email addresses, pho...

PT-2026-103666

Name of the Vulnerable Software and Affected Versions Simply Schedule Appointments versions prior to 1.6.12.33 Description An issue exists that allows unauthenticated attackers to extract customer personally identifiable information PII, such as names, email addresses, phone numbers, and custom...

CVE-2026-92245: Missing Authorization

The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.12.32 via the 'recursive' parameter. This makes it possible for unauthenticated attackers to extract customer PII — including names, email addresses, pho...

CVE-2026-9232

CVE-2026-9232 affects the Easy Appointments plugin for WordPress in all versions up to and including 3.12.27 . A missing authorization check in the handle_customers_ajax (a.k.a. ea_get_customers_ajax) AJAX action allows any authenticated user with contributor-level or higher privileges to extract...

CVE-2026-9232 Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Sensitive Customer Information Exposure via ea_get_customers_ajax AJAX Action

The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.27 via the handlecustomersajax. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the full customer dataset...

CVE-2026-9232 Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Sensitive Customer Information Exposure via ea_get_customers_ajax AJAX Action

The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.27 via the handlecustomersajax. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the full customer dataset...

CVE-2026-13471: Authorization Bypass Through User-Controlled Key

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.3 via the LatePointAbilityDeleteBooking::execute due to missing validation on a user controlled key. This makes it...

EUVD-2026-80186

The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not have any authentication or authorisation checks on one of its report-printing routines, allowing unauthenticated users to retrieve WooCommerce order details and customer contact information, to target an individual order, and ...

CVE-2026-19439 Ultimate Gift Cards for WooCommerce 3.0.3 - 3.2.9 - Unauthenticated Gift Card Code and Customer PII Disclosure via wps_uwgc_report_details

The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not have any authorisation check when displaying gift card details, allowing unauthenticated users to retrieve the gift cards attached to arbitrary orders and disclose customer personal data, balances, dates and, in 3.2.9...

Malicious code in spf-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dece44c5ce884af66714dbff1f022e0345e860d0090cb7bcb30fd7b352cdd77 index.js is a heavily obfuscated browser script obfuscator.io-style string-array + rotation advertised for inclusion via unpkg on Shopify-style...