CVE-2026-76579 LiteSpeed Cache <= 7.9 - Reflected Cross-Site Scripting via ESI 'esi' Parameter

The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'esi' parameter in all versions up to, and including, 7.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

CVE-2026-9832

The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in all versions up to, and including, 5.0.8. This is due to the publicly accessible woocommerceapiwtstripe webhook endpoint EHStripeWebhookHandler::handle wrapping...

CVE-2026-13200

The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2026-13200

The Create plugin for WordPress (by Mediavine) is vulnerable to generic SQL injection via the 'order' parameter in all versions up to and including 2.5.3 . The root cause is insufficient escaping and inadequate preparation of the SQL query. The vulnerable code path in the advanced-filter branch i...

CVE-2026-13200 Create <= 2.5.3 - Authenticated (Author+) SQL Injection via 'order' Parameter

The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

EUVD-2026-83551

The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2026-13200 Create <= 2.5.3 - Authenticated (Author+) SQL Injection via 'order' Parameter

The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2026-9832 Payment Gateway of Stripe for WooCommerce <= 5.0.8 - Unauthenticated Improper Verification of Cryptographic Signature via woocommerce_api_wt_stripe Webhook Endpoint

The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in all versions up to, and including, 5.0.8. This is due to the publicly accessible woocommerceapiwtstripe webhook endpoint EHStripeWebhookHandler::handle wrapping...

CVE-2026-9832

The Payment Gateway of Stripe for WooCommerce WordPress plugin (all versions up to and including 5.0.8 ) is vulnerable to improper verification of cryptographic signature . The publicly accessible woocommerce_api_wt_stripe webhook endpoint wraps its sole call to \Stripe\Webhook::constructEvent() ...

CVE-2026-9832 Payment Gateway of Stripe for WooCommerce <= 5.0.8 - Unauthenticated Improper Verification of Cryptographic Signature via woocommerce_api_wt_stripe Webhook Endpoint

The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in all versions up to, and including, 5.0.8. This is due to the publicly accessible woocommerceapiwtstripe webhook endpoint EHStripeWebhookHandler::handle wrapping...

EUVD-2026-83540

The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in all versions up to, and including, 5.0.8. This is due to the publicly accessible woocommerceapiwtstripe webhook endpoint EHStripeWebhookHandler::handle wrapping...

CVE-2026-92430

The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the authenticity of its PIX payment webhook before updating an order's status, allowing unauthenticated attackers to mark a pending order as paid without paying...

CVE-2026-92430

The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin, affecting versions 3.6.1-5.4.6 , contains an unauthenticated order status manipulation vulnerability. The root cause is the failure to verify the authenticity of its PIX payment webhook before updating an order's...

WordPress Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit plugin 3.6.1-5.4.6 - Unauthenticated Order Status Manipulation vulnerability

Unauthenticated Order Status Manipulation vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin Rede Itaú for WooCommerce versions 3.6.1-5.4.6...

CVE-2026-92430 Rede Itaú for WooCommerce < 5.4.7 - Unauthenticated Order Status Manipulation via PIX Webhook

The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the authenticity of its PIX payment webhook before updating an order's status, allowing unauthenticated attackers to mark a pending order as paid without paying...

EUVD-2026-83516

The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the authenticity of its PIX payment webhook before updating an order's status, allowing unauthenticated attackers to mark a pending order as paid without paying...

CVE-2026-92430 Rede Itaú for WooCommerce < 5.4.7 - Unauthenticated Order Status Manipulation via PIX Webhook

The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the authenticity of its PIX payment webhook before updating an order's status, allowing unauthenticated attackers to mark a pending order as paid without paying...

PT-2026-95797

Name of the Vulnerable Software and Affected Versions Payment Gateway of Stripe for WooCommerce versions prior to 5.0.9 Description Improper Verification of Cryptographic Signature occurs due to the woocommerce api wt stripe webhook endpoint EH Stripe Webhook Handler::handle failing to execute th...

PT-2026-95807

Name of the Vulnerable Software and Affected Versions Datalogics Ecommerce Delivery – Datalogics plugin for WordPress versions prior to 2.6.66 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated...

CVE-2026-92430: Missing Authorization

The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the authenticity of its PIX payment webhook before updating an order's status, allowing unauthenticated attackers to mark a pending order as paid without paying...