EUVD-2026-53718

PeproDev WooCommerce Receipt Uploader PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 slug: pepro-bacs-receipt-upload-for-woocommerce, all versions up to and including 2.8.0 latest on wordpress.org; no fixed version available at the time of writing, is vulnerable to...

CVE-2026-14314 PeproDev WooCommerce Receipt Uploader <= 2.8.0 - Unauthenticated Image Attachment Disclosure via IDOR

The PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 does not verify that a requested attachment belongs to the order referenced by its access token, allowing unauthenticated attackers to forge a token and disclose image attachments, including other customers' uploaded payment...

CVE-2026-14313

The PeproDev WooCommerce Receipt Uploader WordPress plugin (slug: pepro-bacs-receipt-upload-for-woocommerce) is vulnerable to an unauthenticated missing-authorization / IDOR write vulnerability in all versions up to and including 2.8.0 . This flaw allows for unauthenticated order receipt tamperin...

CVE-2026-14313 PeproDev WooCommerce Receipt Uploader <= 2.8.0 - Unauthenticated Order Receipt Tampering via IDOR

PeproDev WooCommerce Receipt Uploader PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 slug: pepro-bacs-receipt-upload-for-woocommerce, all versions up to and including 2.8.0 latest on wordpress.org; no fixed version available at the time of writing, is vulnerable to...

CVE-2026-14313

PeproDev WooCommerce Receipt Uploader PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 slug: pepro-bacs-receipt-upload-for-woocommerce, all versions up to and including 2.8.0 latest on wordpress.org; no fixed version available at the time of writing, is vulnerable to...

CVE-2026-14313: Cross-Site Request Forgery (CSRF)

PeproDev WooCommerce Receipt Uploader PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 slug: pepro-bacs-receipt-upload-for-woocommerce, all versions up to and including 2.8.0 latest on wordpress.org; no fixed version available at the time of writing, is vulnerable to...

CVE-2026-14314: Exposure of Sensitive Information to an Unauthorized Actor

The PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 does not verify that a requested attachment belongs to the order referenced by its access token, allowing unauthenticated attackers to forge a token and disclose image attachments, including other customers' uploaded payment...

CVE-2026-65510

Unauthenticated Cross Site Scripting XSS in PeproDev Ultimate Invoice = 2.2.6 versions...

CVE-2026-65516

Unauthenticated Server Side Request Forgery SSRF in PeproDev Ultimate Invoice = 2.2.6 versions...

CVE-2026-65499

Unauthenticated Broken Access Control in PeproDev Ultimate Invoice = 2.2.6 versions...

CVE-2026-27372

Unauthenticated Sensitive Data Exposure in PeproDev Ultimate Invoice = 2.2.6 versions...

CVE-2026-65516

Unauthenticated Server Side Request Forgery SSRF in PeproDev Ultimate Invoice = 2.2.6 versions...

CVE-2026-65516 WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Server Side Request Forgery SSRF in PeproDev Ultimate Invoice = 2.2.6 versions...

EUVD-2026-48120

Unauthenticated Server Side Request Forgery SSRF in PeproDev Ultimate Invoice = 2.2.6 versions...

CVE-2026-65516

CVE-2026-65516 - Unauthenticated Server-Side Request Forgery in the WordPress plugin PeproDev Ultimate Invoice

CVE-2026-65516 WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Server Side Request Forgery SSRF in PeproDev Ultimate Invoice = 2.2.6 versions...

CVE-2026-65510

Unauthenticated Cross Site Scripting XSS in PeproDev Ultimate Invoice = 2.2.6 versions...

CVE-2026-65510

CVE-2026-65510 is a real issue affecting the WordPress plugin PeproDev Ultimate Invoice

CVE-2026-65510 WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in PeproDev Ultimate Invoice = 2.2.6 versions...

CVE-2026-65510 WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in PeproDev Ultimate Invoice = 2.2.6 versions...