CVE-2026-3891-Pix-for-WooCommerce-Plugin-Exploit

CVE-2026-3891-Pix-for-WooCommerce-Plugin-Exploit 🛡️ Description CVE-2026-3891 is a critical Unauthenticated Arbitrary File Upload vulnerability found in the Pix for WooCommerce WordPress plugin in versions up to and including 1.5.0. The vulnerability exists in the lknpixforwoocommercec6savesetting...

CVE-2026-93528

📌 CVE-2026-93528: Unauthenticated Order Data Disclosure in NP Quote Request for WooCommerce • Vulnerability Type: Sensitive Data Disclosure CWE-200 • Affected Software: woo-rfq-for-woocommerce 2.4.16 • Original Researcher: Murad Islamzada • Vendor: Neah Plugins Cyrus 1. Overview & Root Cause The...

CVE-2026-3891

Pix for WooCommerce = 1.5.0 - Unauthenticated Arbitrary File Upload CVE-2026-3891 PoC 📜 Description CVE-2026-3891 is an unauthenticated arbitrary file upload vulnerability in the Pix for WooCommerce WordPress plugin. The plugin exposes an AJAX endpoint lknpixforwoocommercec6savesettings that...

CVE-2026-107863

Missing Authorization vulnerability in Codection Products Restricted Users for WooCommerce woo-products-restricted-users allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Products Restricted Users for WooCommerce: from n/a through 0.7...

CVE-2023-25996

Insertion of Sensitive Information Into Sent Data vulnerability in Pluggabl LLC. Booster Elite for WooCommerce booster-elite-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Booster Elite for WooCommerce: from n/a before 8.4.0...

CVE-2026-107863

The Products Restricted Users for WooCommerce WordPress plugin (versions

EUVD-2026-97296

Missing Authorization vulnerability in Codection Products Restricted Users for WooCommerce woo-products-restricted-users allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Products Restricted Users for WooCommerce: from n/a through 0.7...

CVE-2026-107863 WordPress Products Restricted Users for WooCommerce plugin <= 0.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in Codection Products Restricted Users for WooCommerce woo-products-restricted-users allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Products Restricted Users for WooCommerce: from n/a through 0.7...

WordPress Products Restricted Users for WooCommerce plugin <= 0.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Oly Hossen in WordPress Plugin Products Restricted Users for WooCommerce versions = 0.7...

CVE-2026-106605

Improper Validation of Specified Quantity in Input vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Input Data Manipulation.This issue affects Flexible Quantity – Measurement Price...

EUVD-2023-60710

Insertion of Sensitive Information Into Sent Data vulnerability in Pluggabl LLC. Booster Elite for WooCommerce booster-elite-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Booster Elite for WooCommerce: from n/a before 8.4.0...

CVE-2023-25996

The Booster Elite for WooCommerce plugin by Pluggabl LLC is vulnerable to an Authenticated Arbitrary WordPress Option Disclosure vulnerability in versions prior to 8.4.0 . This issue allows an authenticated user to retrieve embedded sensitive data from the WordPress options table. The root cause ...

CVE-2023-25996 WordPress Booster Elite for WooCommerce plugin < 8.4.0 - Authenticated Arbitrary WordPress Option Disclosure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Pluggabl LLC. Booster Elite for WooCommerce booster-elite-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Booster Elite for WooCommerce: from n/a before 8.4.0...

WordPress Booster Elite for WooCommerce plugin < 8.4.0 - Authenticated Arbitrary WordPress Option Disclosure vulnerability

Authenticated Arbitrary WordPress Option Disclosure vulnerability discovered by Dave Jong Patchstack in WordPress Plugin Booster Elite for WooCommerce versions 8.4.0...

CVE-2026-106605

The WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce plugin is vulnerable to an Improper Validation of Specified Quantity in Input vulnerability (CWE-1284) in versions n/a through 2.3.22 . This flaw allows for Input Data Manipulation . No specific root cause details, remed...

EUVD-2026-97286

Improper Validation of Specified Quantity in Input vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Input Data Manipulation.This issue affects Flexible Quantity – Measurement Price...

CVE-2026-106605 WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.22 - Other vulnerability Type vulnerability

Improper Validation of Specified Quantity in Input vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Input Data Manipulation.This issue affects Flexible Quantity – Measurement Price...

WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.22 - Other vulnerability Type vulnerability

Other vulnerability Type vulnerability discovered by Peter Tang in WordPress Plugin Flexible Quantity – Measurement Price Calculator for WooCommerce versions = 2.3.22...

VidShop for WooCommerce <= 1.1.4 - SQL Injection

VidShop – Shoppable Videos for WooCommerce plugin for WordPress = 1.1.4 contains a time-based SQL injection caused by insufficient escaping of the 'fields' parameter, letting unauthenticated attackers extract sensitive database information. id: CVE-2026-0702 info: name: VidShop for WooCommerce =...

Hippoo Mobile App for WooCommerce - Broken Access Control

Hippoo Mobile App for WooCommerce = 1.9.4 contains a broken access control vulnerability caused by incorrect privilege assignment, letting attackers escalate their privileges, exploit requires no special conditions. id: CVE-2026-49060 info: name: Hippoo Mobile App for WooCommerce - Broken Access...