CVE-2026-16739: Improper Authentication

The Epeken All Kurir for Woocommerce WordPress plugin through 2.1.4 does not verify that a payment-confirmation request originates from the owner of the targeted order, nor that any payment actually occurred, allowing unauthenticated attackers to mark arbitrary orders as confirmed and, in a...

PT-2026-71967

Name of the Vulnerable Software and Affected Versions Epeken All Kurir for Woocommerce WordPress versions prior to 2.1.3 Description An issue exists where the plugin fails to verify if a payment-confirmation request is sent by the order owner or if a payment was actually processed. This allows...

SUSE CVE-2026-68403

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: initialize SDIO data work before cleanup brcmfsdioprobe stores the newly allocated bus in sdiodev-bus before allocating the ordered workqueue. If that allocation fails, the function jumps to fail and calls...

CVE-2026-66700

Unauthenticated Cross Site Scripting XSS in Smart Online Order for Clover = 1.6.1 versions...

CVE-2026-66424

Unauthenticated Privilege Escalation in SMS Alert Order Notifications = 3.9.7 versions...

CVE-2026-66700

Unauthenticated Cross Site Scripting XSS in Smart Online Order for Clover = 1.6.1 versions...

CVE-2026-66700

CVE-2026-66700 affects the WordPress plugin “Smart Online Order for Clover” (versions <= 1.6.1). The vulnerability is an Unauthenticated Cross Site Scripting (XSS) flaw reported for that plugin, indicating an attacker can inject scripts without authentication. Connected records confirm the aff...

EUVD-2026-57906

Unauthenticated Cross Site Scripting XSS in Smart Online Order for Clover = 1.6.1 versions...

CVE-2026-66700 WordPress Smart Online Order for Clover plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Smart Online Order for Clover = 1.6.1 versions...

CVE-2026-66700 WordPress Smart Online Order for Clover plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Smart Online Order for Clover = 1.6.1 versions...

CVE-2026-66424

CVE-2026-66424 affects the WordPress plugin SMS Alert Order Notifications (versions

CVE-2026-66424 WordPress SMS Alert Order Notifications plugin <= 3.9.7 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in SMS Alert Order Notifications = 3.9.7 versions...

CVE-2026-66424

Unauthenticated Privilege Escalation in SMS Alert Order Notifications = 3.9.7 versions...

CVE-2026-66424 WordPress SMS Alert Order Notifications plugin <= 3.9.7 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in SMS Alert Order Notifications = 3.9.7 versions...

EUVD-2026-57860

Unauthenticated Privilege Escalation in SMS Alert Order Notifications = 3.9.7 versions...

WordPress Eventin plugin < 4.1.20 - Contributor+ Order Information Disclosure via IDOR vulnerability

Contributor+ Order Information Disclosure via IDOR vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin WP Event SOlution versions 4.1.20...

CVE-2026-18945

The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX actions, allowing unauthenticated users to view other customers' order details, including personal information, as well as change t...

CVE-2026-18945

The WP Helper Premium WordPress plugin (versions before 4.7.6 ) is vulnerable to an authorization bypass due to a missing order key validation . The flaw occurs when the plugin renders its custom order confirmation page or handles related AJAX actions. This allows unauthenticated users to view se...

EUVD-2026-57728

The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX actions, allowing unauthenticated users to view other customers' order details, including personal information, as well as change t...

CVE-2026-18945

The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX actions, allowing unauthenticated users to view other customers' order details, including personal information, as well as change t...