5920 matches found
EUVD-2026-58839
The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.36. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated...
CVE-2026-8840
The CVE-2026-8840 entry concerns the Booking calendar, Appointment Booking System plugin for WordPress, affected up to version 3.2.36. The vulnerability is an authorization bypass caused by inadequate verification of a user’s permission to perform actions, enabling unauthenticated attackers to ma...
CVE-2026-8840 Booking calendar, Appointment Booking System <= 3.2.36 - Missing Authorization to Unauthenticated Arbitrary Modification via wpdevart_payment AJAX Action
The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.36. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated...
CVE-2026-8840
The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.36. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated...
PT-2026-72149
The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.36. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated...
WordPress Epeken All Kurir plugin <= 2.1.2 - Unauthenticated Order Payment Confirmation Forgery vulnerability
Unauthenticated Order Payment Confirmation Forgery vulnerability discovered by Pedro Pinho in WordPress Plugin Epeken All Kurir versions = 2.1.2...
WordPress Quick PayPal Payments plugin <= 5.7.50 - Unauthenticated Payment Bypass via PayPal IPN vulnerability
Unauthenticated Payment Bypass via PayPal IPN vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Quick Paypal Payments versions = 5.7.50...
WordPress Payment Button for PayPal plugin <= 1.2.3.44 - Unauthenticated Payment Price Manipulation vulnerability
Unauthenticated Payment Price Manipulation vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Payment Button for PayPal versions = 1.2.3.44...
WordPress Payment Gateway for PayPal on WooCommerce plugin < 9.2.1 - Unauthenticated Payment Bypass via PayPal Advanced Return Handler vulnerability
Unauthenticated Payment Bypass via PayPal Advanced Return Handler vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Payment Gateway for PayPal on WooCommerce versions 9.2.1...
WordPress Welcart e-Commerce plugin < 2.11.33 - Unauthenticated Payment Bypass via Forged Settlement Callback vulnerability
Unauthenticated Payment Bypass via Forged Settlement Callback vulnerability discovered by Pedro Pinho in WordPress Plugin Welcart e-Commerce versions 2.11.33...
CVE-2026-16739
The Epeken All Kurir for Woocommerce WordPress plugin through 2.1.2 does not verify that a payment-confirmation request originates from the owner of the targeted order, nor that any payment actually occurred, allowing unauthenticated attackers to mark arbitrary orders as confirmed and, in a...
CVE-2026-15205
The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows...
CVE-2026-16739
The Epeken All Kurir for Woocommerce WordPress plugin through 2.1.2 does not verify that a payment-confirmation request originates from the owner of the targeted order, nor that any payment actually occurred, allowing unauthenticated attackers to mark arbitrary orders as confirmed and, in a...
CVE-2026-16739 Epeken All Kurir <= 2.1.2 - Unauthenticated Order Payment Confirmation Forgery
The Epeken All Kurir for Woocommerce WordPress plugin through 2.1.2 does not verify that a payment-confirmation request originates from the owner of the targeted order, nor that any payment actually occurred, allowing unauthenticated attackers to mark arbitrary orders as confirmed and, in a...
CVE-2026-15205 Paymob for WooCommerce < 4.1.9 - Unauthenticated SQL Injection via Paymob Callback Pixel Lookup
The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows...
CVE-2026-16739
The CVE concerns the WordPress plugin Epeken All Kurir for WooCommerce, affected
EUVD-2026-58597
The Epeken All Kurir for Woocommerce WordPress plugin through 2.1.2 does not verify that a payment-confirmation request originates from the owner of the targeted order, nor that any payment actually occurred, allowing unauthenticated attackers to mark arbitrary orders as confirmed and, in a...
EUVD-2026-58596
The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows...