CVE-2026-12402

The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fb-config' Setting in all versions up to, and including, 2.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-12402

CVE-2026-12402 affects the OTP Login & Register Woocommerce plugin for WordPress in all versions up to and including 2.7.3 . The vulnerability is a Stored Cross-Site Scripting (XSS) in the 'fb-config' Setting , caused by insufficient input sanitization and output escaping. An authenticated attack...

EUVD-2026-83553

The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fb-config' Setting in all versions up to, and including, 2.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-12402 OTP Login & Register Woocommerce <= 2.7.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'fb-config' Setting

The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fb-config' Setting in all versions up to, and including, 2.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-12402 OTP Login & Register Woocommerce <= 2.7.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'fb-config' Setting

The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fb-config' Setting in all versions up to, and including, 2.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-12402: Improper Neutralization of Input During Web Page Generation

The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fb-config' Setting in all versions up to, and including, 2.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2026-95773

Name of the Vulnerable Software and Affected Versions OTP Login & Register Woocommerce versions prior to 2.7.4 Description Insufficient input sanitization and output escaping in the fb-config setting allow authenticated attackers with administrator-level access or higher to perform Stored...

CVE-2026-12215

The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authentication Bypass via OTP Brute Force in all versions up to, and including, 2.7.2. The vulnerability exists because the OTP rate-limit attempt counter in processotpform is keyed exclusively on the attacker-controlled...

CVE-2026-12215 OTP Login & Register Woocommerce <= 2.7.2 - Unauthenticated Authentication Bypass via Brute Force

The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authentication Bypass via OTP Brute Force in all versions up to, and including, 2.7.2. The vulnerability exists because the OTP rate-limit attempt counter in processotpform is keyed exclusively on the attacker-controlled...

CVE-2026-12215 OTP Login & Register Woocommerce <= 2.7.2 - Unauthenticated Authentication Bypass via Brute Force

The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authentication Bypass via OTP Brute Force in all versions up to, and including, 2.7.2. The vulnerability exists because the OTP rate-limit attempt counter in processotpform is keyed exclusively on the attacker-controlled...

PT-2026-89747

The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authentication Bypass via OTP Brute Force in all versions up to, and including, 2.7.2. The vulnerability exists because the OTP rate-limit attempt counter in process otp form is keyed exclusively on the attacker-controlled...

CVE-2026-12215: Unrestricted Upload of File with Dangerous Type

The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authentication Bypass via OTP Brute Force in all versions up to, and including, 2.7.2. The vulnerability exists because the OTP rate-limit attempt counter in processotpform is keyed exclusively on the attacker-controlled...