CVE-2026-74009

The WordPress Razorpay for WooCommerce plugin (versions ≤ 4.8.7) has an unauthenticated IDOR vulnerability allowing unauthorized access to arbitrary object references. CVSS 5.3 (MEDIUM) reflects low integrity impact. Exploitation details are not provided. Upgrade to a patched version beyond 4.8.7...

EUVD-2026-60817

Unauthenticated Insecure Direct Object References IDOR in Razorpay for WooCommerce = 4.8.7 versions...

CVE-2026-73396 WordPress MWB HubSpot for WooCommerce plugin <= 1.6.7 - Broken Authentication vulnerability

Subscriber Broken Authentication in MWB HubSpot for WooCommerce = 1.6.7 versions...

CVE-2026-73396

The MWB HubSpot for WooCommerce plugin (≤1.6.7) has a broken authentication flaw exploitable by any logged-in subscriber over the network with low complexity, causing high availability impact and low integrity impact (CVSS 7.1); upgrading beyond 1.6.7 is recommended. Patchstack advisory: https://...

EUVD-2026-60802

Subscriber Broken Authentication in MWB HubSpot for WooCommerce = 1.6.7 versions...

CVE-2026-73345

Customer SQL Injection in License Manager for WooCommerce = 3.0.18 versions...

EUVD-2026-60775

Customer SQL Injection in License Manager for WooCommerce = 3.0.18 versions...

CVE-2026-73345

SQL injection in License Manager for WooCommerce

WordPress Razorpay for WooCommerce plugin <= 4.8.7 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Razorpay for WooCommerce versions = 4.8.7...

WordPress Paymob for WooCommerce plugin < 4.1.9 - Unauthenticated SQL Injection via Paymob Callback Pixel Lookup vulnerability

Unauthenticated SQL Injection via Paymob Callback Pixel Lookup vulnerability discovered by Artus KG in WordPress Plugin Paymob for WooCommerce versions 4.1.9...

WordPress Wallet System for WooCommerce plugin < 2.7.10 - Customer+ Checkout Price Manipulation via Unvalidated Wallet Amount vulnerability

Customer+ Checkout Price Manipulation via Unvalidated Wallet Amount vulnerability discovered by takuma in WordPress Plugin Wallet System for WooCommerce versions 2.7.10...

CVE-2026-15205

The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows...

CVE-2026-15205

The CVE concerns the Paymob for WooCommerce WordPress plugin (versions

EUVD-2026-58596

The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows...

CVE-2026-15205 Paymob for WooCommerce < 4.1.9 - Unauthenticated SQL Injection via Paymob Callback Pixel Lookup

The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows...

CVE-2026-73346

Administrator SQL Injection in MailChimp For WooCommerce 6.2 versions...

CVE-2026-73353 WordPress Revolut Gateway for WooCommerce plugin < 4.22.10 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Revolut Gateway for WooCommerce 4.22.10 versions...

CVE-2026-73346 WordPress MailChimp For WooCommerce plugin < 6.2 - SQL Injection vulnerability

Administrator SQL Injection in MailChimp For WooCommerce 6.2 versions...

CVE-2026-73346

The CVE concerns the WordPress plugin MailChimp For WooCommerce (affected: versions

CVE-2026-14182

The CVE-2026-14182 affects the Customer Email Verification for WooCommerce WordPress plugin prior to 3.2.6. The vulnerability stems from incorrect validation of the email-verification activation code, using a loose (type-j juggling) comparison that a crafted value can satisfy. This allows unauthe...