31 matches found
CVE-2026-79630
The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a checkout order bump is the product that bump's discount was configured for, allowing unauthenticated users to obtain any purchasable product at a discount intended for a different one, with the reduc...
EUVD-2026-70904
The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a checkout order bump is the product that bump's discount was configured for, allowing unauthenticated users to obtain any purchasable product at a discount intended for a different one, with the reduc...
CVE-2026-79630
The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a checkout order bump is the product that bump's discount was configured for, allowing unauthenticated users to obtain any purchasable product at a discount intended for a different one, with the reduc...
CVE-2026-79630 WPFunnels < 3.13.0 - Unauthenticated Price Manipulation via Order Bump Product ID Substitution
The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a checkout order bump is the product that bump's discount was configured for, allowing unauthenticated users to obtain any purchasable product at a discount intended for a different one, with the reduc...
CVE-2026-79630 WPFunnels < 3.13.0 - Unauthenticated Price Manipulation via Order Bump Product ID Substitution
The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a checkout order bump is the product that bump's discount was configured for, allowing unauthenticated users to obtain any purchasable product at a discount intended for a different one, with the reduc...
CVE-2026-79630: Authorization Bypass Through User-Controlled Key
The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a checkout order bump is the product that bump's discount was configured for, allowing unauthenticated users to obtain any purchasable product at a discount intended for a different one, with the reduc...
PT-2026-85414
The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a checkout order bump is the product that bump's discount was configured for, allowing unauthenticated users to obtain any purchasable product at a discount intended for a different one, with the reduc...
CVE-2026-81288
Unauthenticated Cross Site Scripting XSS in Upsell Order Bump Offer for WooCommerce = 3.1.5 versions...
CVE-2026-81288 WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Upsell Order Bump Offer for WooCommerce = 3.1.5 versions...
EUVD-2026-69924
Unauthenticated Cross Site Scripting XSS in Upsell Order Bump Offer for WooCommerce = 3.1.5 versions...
CVE-2026-81288
CVE-2026-81288 is an unauthenticated Cross Site Scripting (XSS) vulnerability in the Upsell Order Bump Offer for WooCommerce WordPress plugin, affecting versions 3.1.5 and below . The CVSS v3.1 score is 7.1 (HIGH) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L , indicating a network-based attack...
CVE-2026-81288 WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Upsell Order Bump Offer for WooCommerce = 3.1.5 versions...
CVE-2026-81288: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Upsell Order Bump Offer for WooCommerce = 3.1.5 versions...
PT-2026-84685
Unauthenticated Cross Site Scripting XSS in Upsell Order Bump Offer for WooCommerce = 3.1.5 versions...
WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ivaylo Atanassov in WordPress Plugin Upsell Order Bump Offer for WooCommerce versions = 3.1.5...
CVE-2026-49110
Unauthenticated Broken Authentication in Upsell Order Bump Offer for WooCommerce = 3.1.4 versions...
CVE-2026-49110 WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.4 - Price Manipulation vulnerability
Unauthenticated Broken Authentication in Upsell Order Bump Offer for WooCommerce = 3.1.4 versions...
CVE-2026-49110
The CVE-2026-49110 entry concerns the WordPress plugin Upsell Order Bump Offer for WooCommerce, affected in versions <= 3.1.4. It describes an Unauthenticated Broken Authentication vulnerability enabling price manipulation in Upsell Order Bump offers. CVSSv3.1 metrics indicate Network attack v...
EUVD-2026-36885
Unauthenticated Broken Authentication in Upsell Order Bump Offer for WooCommerce = 3.1.4 versions...
CVE-2026-49110 WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.4 - Price Manipulation vulnerability
Unauthenticated Broken Authentication in Upsell Order Bump Offer for WooCommerce = 3.1.4 versions...