WP Finance Plugin <= 1.3.6 - Cross-Site Scripting

WP Finance WordPress plugin = 1.3.6 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before output, letting attackers execute scripts in high privilege users' browsers, exploit requires victim to click a malicious link. id: CVE-2024-13097 info:...

aegis-finance-mcp (0.1.1), agent-mcp-server (0.0.4.0) +135 more potentially affected by unknown CVE via uv (>=0.1.45, <=0.12.24)

uv PYPI version =0.1.45, =0.11.0, =0.4.7, =0.0.21, =1.2.0rc5, =0.71.2.dev141039313338033, =0.112.0, =0.1.0, =0.1.2, =1.0.3, =0.5.0.dev0, =0.8.0.dev0 - cdm-ecommerce-backend 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:PYSEC-2026-4321...

aegis-finance-mcp (0.1.1), agent-mcp-server (0.0.4.0) +135 more potentially affected by unknown CVE via uv (>=0.1.45, <=0.12.24)

uv PYPI version =0.1.45, =0.11.0, =0.4.7, =0.0.21, =1.2.0rc5, =0.71.2.dev141039313338033, =0.112.0, =0.1.0, =0.1.2, =1.0.3, =0.5.0.dev0, =0.8.0.dev0 - cdm-ecommerce-backend 0.1.0 and more Source cves: unknown CVE Source advisory: GHSA-HQ85-5CPJ-MR62...

aegis-finance-mcp (0.1.1), agent-mcp-server (0.0.4.0) +135 more potentially affected by unknown CVE via uv (>=0.1.45, <=0.12.24)

uv PYPI version =0.1.45, =0.11.0, =0.4.7, =0.0.21, =1.2.0rc5, =0.71.2.dev141039313338033, =0.112.0, =0.1.0, =0.1.2, =1.0.3, =0.5.0.dev0, =0.8.0.dev0 - cdm-ecommerce-backend 0.1.0 and more Source cves: unknown CVE Source advisory: SNYK:PYTHON-UV-21460703...

CVE-2026-94272

The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail...

WordPress Snap Finance plugin 1.0.8-3.11.0 - Unauthenticated Arbitrary Order Status Change vulnerability

Unauthenticated Arbitrary Order Status Change vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin Snap Finance versions 1.0.8-3.11.0...

EUVD-2026-104106

The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail...

CVE-2026-94272 Snap Finance 1.0.8 - 3.11.0 - Unauthenticated Arbitrary Order Status Change via Multiple AJAX Actions

The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail...

CVE-2026-94272 Snap Finance 1.0.8 - 3.11.0 - Unauthenticated Arbitrary Order Status Change via Multiple AJAX Actions

The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail...

CVE-2026-94272

The Snap Finance WordPress plugin versions before 3.12.0 is vulnerable to an authentication bypass. The plugin fails to verify that requests to change a WooCommerce order's status originate from an authorized source. This allows unauthenticated attackers to manipulate order states, such as moving...

CVE-2026-94273

The Snap Finance WordPress plugin through 3.11.0 does not verify that the payment provider's response actually confirms a completed, approved transaction before marking a WooCommerce order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without completing payment...

CVE-2026-94273

The Snap Finance WordPress plugin (versions through 3.11.0 ) is vulnerable to an unauthenticated payment confirmation forgery. The root cause is a failure to verify that the payment provider's response confirms a completed and approved transaction before marking a WooCommerce order as paid. This ...

WordPress Snap Finance plugin <= 3.11.0 - Unauthenticated Payment Confirmation Forgery vulnerability

Unauthenticated Payment Confirmation Forgery vulnerability discovered by Ryan Fabella in WordPress Plugin Snap Finance versions = 3.12.0...

CVE-2026-94273 Snap Finance <= 3.11.0 - Unauthenticated Payment Confirmation Forgery via snap_finance_complete_payment

The Snap Finance WordPress plugin through 3.11.0 does not verify that the payment provider's response actually confirms a completed, approved transaction before marking a WooCommerce order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without completing payment...

CVE-2026-94273 Snap Finance <= 3.11.0 - Unauthenticated Payment Confirmation Forgery via snap_finance_complete_payment

The Snap Finance WordPress plugin through 3.11.0 does not verify that the payment provider's response actually confirms a completed, approved transaction before marking a WooCommerce order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without completing payment...

EUVD-2026-104088

The Snap Finance WordPress plugin through 3.11.0 does not verify that the payment provider's response actually confirms a completed, approved transaction before marking a WooCommerce order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without completing payment...

CVE-2026-94272: Missing Authorization

The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail...

CVE-2026-94273: Missing Authorization

The Snap Finance WordPress plugin through 3.11.0 does not verify that the payment provider's response actually confirms a completed, approved transaction before marking a WooCommerce order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without completing payment...

PT-2026-117256

The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail...

PT-2026-117239

Name of the Vulnerable Software and Affected Versions Snap Finance WordPress plugin versions prior to 3.11.1 Description The plugin fails to verify if the payment provider response confirms a completed and approved transaction before updating a WooCommerce order status to paid. This allows...