EUVD-2026-50097

The Wholesale for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.5. This is due to the saverequestsmeta function applying only sanitizetextfield to the userroleset POST parameter before passing it directly to WPUser::addrole, with ...

CVE-2026-59530

Unauthenticated Broken Access Control in Stripe For WooCommerce = 4.0.7 versions...

CVE-2026-65434

The CVE-2026-65434 entry concerns the WordPress plugin ЮKassa для WooCommerce (YuKassa for WooCommerce)

EUVD-2026-49229

Subscriber Sensitive Data Exposure in ЮKassa для WooCommerce = 2.16.1 versions...

CVE-2026-59530 WordPress Stripe For WooCommerce plugin <= 4.0.7 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Stripe For WooCommerce = 4.0.7 versions...

EUVD-2026-49206

Unauthenticated Broken Access Control in Stripe For WooCommerce = 4.0.7 versions...

CVE-2026-12493

The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin before 1.3.6 does not verify that an approved external payment record actually belongs to the WooCommerce order being completed, nor that the paid amount matches the order total, allowing unauthenticated users to mark arbitrar...

CVE-2026-15648

The CVE-2026-15648 entry concerns the Brands for WooCommerce plugin for WordPress. Affected: all versions up to 3.8.8. Issue: Stored Cross-Site Scripting via the width shortcode attribute caused by insufficient input sanitization and output escaping. Impact: authenticated attackers with contribut...

EUVD-2026-48508

The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'width' Shortcode Attribute in all versions up to, and including, 3.8.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-15648 Brands for WooCommerce <= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute

The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'width' Shortcode Attribute in all versions up to, and including, 3.8.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

EUVD-2026-48112

Unauthenticated Insecure Direct Object References IDOR in Shiptastic for WooCommerce = 5.1.0 versions...

CVE-2026-65501

CVE-2026-65501 affects the WordPress plugin Shiptastic for WooCommerce (versions

CVE-2026-65501

Unauthenticated Insecure Direct Object References IDOR in Shiptastic for WooCommerce = 5.1.0 versions...

WordPress Stripe For WooCommerce plugin <= 4.0.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by timomangcut in WordPress Plugin Stripe For WooCommerce versions = 4.0.7...

EUVD-2026-47924

The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'brbrandtooltip' Term Meta Field in all versions up to, and including, 3.8.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-15647

Affected software: Brands for WooCommerce (WordPress plugin). Vulnerable component: br_brand_tooltip term meta; root cause: insufficient input sanitization and output escaping. Impact: authenticated attackers with custom-level access can store scripts via term meta, leading to stored XSS when pag...

Exploit for CVE-2026-3891

CVE-2026-3891 — Pix for WooCommerce Unauthenticated File Upload...

Exploit for CVE-2026-3891

CVE-2026-3891-Pix-for-WooCommerce-Plugin-Exploit 🛡️ Descri...

CVE-2026-57810 WordPress APIExperts Square for WooCommerce plugin <= 4.7.4 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Saad Iqbal APIExperts Square for WooCommerce woosquare allows Blind SQL Injection.This issue affects APIExperts Square for WooCommerce: from n/a through = 4.7.4...

CVE-2026-57709

CVE-2026-57709 affects the WordPress plugin WP Swings Membership For WooCommerce (Membership For WooCommerce) up to version 3.1.0. The issue is a path traversal vulnerability caused by improper limitation of a pathname to a restricted directory, enabling arbitrary file deletion. CVSS v3.1 base sc...