CVE-2026-14900 Cost Calculator Builder PRO <= 4.0.3 - Unauthenticated Remote Code Execution via 'orderDetails' Parameter

The Cost Calculator Builder PRO plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.0.3 via the jstophp function. This is due to insufficient sanitization of the orderDetails.originalValue field, which is injected verbatim into a calculator formula...

CVE-2026-14900

The CVE-2026-14900 entry concerns the WordPress plugin Cost Calculator Builder PRO (versions up to 4.0.3). The root cause is insufficient sanitization of the orderDetails[*].originalValue field, which is injected verbatim into a calculator formula string passed to PHP eval() inside the js_to_php(...

CVE-2026-14900 Cost Calculator Builder PRO <= 4.0.3 - Unauthenticated Remote Code Execution via 'orderDetails' Parameter

The Cost Calculator Builder PRO plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.0.3 via the jstophp function. This is due to insufficient sanitization of the orderDetails.originalValue field, which is injected verbatim into a calculator formula...

CVE-2026-16597

Summary: CVE-2026-16597 affects the GTM4WP WordPress plugin (versions ≤ 1.22.3) and allows unauthenticated stored XSS via WooCommerce Billing Fields when the GTM4WP_OPTION_INTEGRATE_WCORDERDATA option is enabled. The root cause is insufficient input sanitization and output escaping in the plugin’...

EUVD-2026-50266

The GTM4WP – A Google Tag Manager GTM plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via WooCommerce Billing Fields in all versions up to, and including, 1.22.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-64421

A flaw was found in the Linux kernel's imx8-isi media driver. This use-after-free vulnerability occurs during the removal of the driver due to an incorrect order of cleanup operations. A local attacker could potentially exploit this to cause a denial of service or achieve arbitrary code execution...

CVE-2026-13692

The PayU CommercePro Plugin WordPress plugin before 3.9.0 does not verify the payment-gateway signature before applying order modifications, allowing unauthenticated attackers to tamper with the totals, shipping and metadata of arbitrary WooCommerce orders...

EUVD-2026-50118

The PayU CommercePro Plugin WordPress plugin through 3.8.9 does not verify the payment-gateway signature before applying order modifications, allowing unauthenticated attackers to tamper with the totals, shipping and metadata of arbitrary WooCommerce orders...

WordPress PayU CommercePro Plugin plugin <= 3.8.9 - Unauthenticated Order Tampering vulnerability

Unauthenticated Order Tampering vulnerability discovered by J4ck13Ch4n in WordPress Plugin PayU India versions = 3.8.9...

CVE-2026-13692 PayU CommercePro < 3.9.0 - Unauthenticated Order Tampering

The PayU CommercePro Plugin WordPress plugin before 3.9.0 does not verify the payment-gateway signature before applying order modifications, allowing unauthenticated attackers to tamper with the totals, shipping and metadata of arbitrary WooCommerce orders...

CVE-2026-13692

The PayU CommercePro Plugin for WordPress (versions before 3.9.0 ) contains a vulnerability where it fails to verify the payment-gateway signature before applying order modifications. This flaw allows unauthenticated attackers to tamper with the totals, shipping details, and metadata of arbitrary...

CVE-2026-13692

The PayU CommercePro Plugin WordPress plugin before 3.9.0 does not verify the payment-gateway signature before applying order modifications, allowing unauthenticated attackers to tamper with the totals, shipping and metadata of arbitrary WooCommerce orders...

PT-2026-65770

The Cost Calculator Builder PRO plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.0.3 via the js to php function. This is due to insufficient sanitization of the orderDetails.originalValue field, which is injected verbatim into a calculator formul...

PT-2026-65694

The PayU CommercePro Plugin WordPress plugin through 3.8.9 does not verify the payment-gateway signature before applying order modifications, allowing unauthenticated attackers to tamper with the totals, shipping and metadata of arbitrary WooCommerce orders...

CVE-2026-13692: Missing Authorization

The PayU CommercePro Plugin WordPress plugin before 3.9.0 does not verify the payment-gateway signature before applying order modifications, allowing unauthenticated attackers to tamper with the totals, shipping and metadata of arbitrary WooCommerce orders...

CVE-2026-51304

A flaw was found in sqlite. A remote attacker can exploit a use-after-free vulnerability in the ORDER BY clause parsing routine by crafting a malicious SQL statement. This can lead to an application crash, sensitive information disclosure, and in some cases, arbitrary code execution, allowing the...

CVE-2026-8164

Uncontrolled Search Path Element vulnerability in ArkSigner Software and Hardware Industry and Trade Inc. ArkSigner Desktop Client allows Search Order Hijacking. This issue affects ArkSigner Desktop Client: from v2.2.16.10 through 17062026...

CVE-2026-8164

Uncontrolled Search Path Element vulnerability in ArkSigner Software and Hardware Industry and Trade Inc. ArkSigner Desktop Client allows Search Order Hijacking. This issue affects ArkSigner Desktop Client: from v2.2.16.10 through 17062026...

CVE-2026-8164

CVE-2026-8164: Uncontrolled Search Path Element affecting ArkSigner Desktop Client (ArkSigner Software and Hardware Industry and Trade Inc.). Affected versions: v2.2.16.10 through 17062026. Impact: high for confidentiality, integrity, and availability. Attack vector: LOCAL; prerequisites: LOW pri...

CVE-2026-8164 Search Order Hijacking in ArkSigner's ArkSigner Desktop Client

Uncontrolled Search Path Element vulnerability in ArkSigner Software and Hardware Industry and Trade Inc. ArkSigner Desktop Client allows Search Order Hijacking. This issue affects ArkSigner Desktop Client: from v2.2.16.10 through 17062026...