Magneto-PolyShell

Magento 2 RCE Exploit - Unauthenticated File Upload to RCE ⚠️ This tool is for educational and authorized security testing only. Unauthorized use against systems you do not own is illegal. This exploit targets a critical unauthenticated remote code execution RCE vulnerability in Magento 2 Adobe...

WordPress WPC Product Options for WooCommerce plugin <= 4.0.5 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Sebastian Albrecht mySebbe in WordPress Plugin WPC Product Options for WooCommerce versions = 4.0.5...

CVE-2026-97660

The WPC Product Options for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wpcpo- Array Key via Multipart Field Name in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate...

EUVD-2026-91952

The WPC Product Options for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wpcpo- Array Key via Multipart Field Name in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate...

CVE-2026-97660 WPC Product Options for WooCommerce <= 4.0.5 - Unauthenticated Stored Cross-Site Scripting via wpcpo-* Array Key via Multipart Field Name

The WPC Product Options for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wpcpo- Array Key via Multipart Field Name in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate...

CVE-2026-97660 WPC Product Options for WooCommerce <= 4.0.5 - Unauthenticated Stored Cross-Site Scripting via wpcpo-* Array Key via Multipart Field Name

The WPC Product Options for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wpcpo- Array Key via Multipart Field Name in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate...

CVE-2026-97660

The WPC Product Options for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 4.0.5 . The root cause is insufficient input sanitization and output escaping. Unauthenticated attackers can exploit this via a guest checkout by emb...

CVE-2026-97660: Improper Neutralization of Input During Web Page Generation

The WPC Product Options for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wpcpo- Array Key via Multipart Field Name in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate...

PT-2026-104551

Name of the Vulnerable Software and Affected Versions WPC Product Options for WooCommerce versions prior to 4.0.6 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. The issue occurs when a malicious payload is...

CVE-2026-102392

Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields = 3.3.8 versions...

CVE-2026-102392

The Extra Product Options For WooCommerce | Custom Product Addons and Fields plugin for WordPress is vulnerable to a PHP Object Injection vulnerability in versions

CVE-2026-102392 WordPress Extra Product Options For WooCommerce | Custom Product Addons and Fields plugin <= 3.3.8 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields = 3.3.8 versions...

CVE-2026-102392 WordPress Extra Product Options For WooCommerce | Custom Product Addons and Fields plugin <= 3.3.8 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields = 3.3.8 versions...

EUVD-2026-90225

Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields = 3.3.8 versions...

WordPress Extra Product Options For WooCommerce | Custom Product Addons and Fields plugin <= 3.3.8 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Extra Product Options For WooCommerce | Custom Product Addons and Fields versions = 3.3.8...

PT-2026-103490

Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields = 3.3.8 versions...

CVE-2026-102392: Deserialization of Untrusted Data

Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields = 3.3.8 versions...

WordPress Extra Product Options Builder for WooCommerce plugin < 1.2.176 - Unauthenticated Customer File Disclosure via getpublicfileupload vulnerability

Unauthenticated Customer File Disclosure via getpublicfileupload vulnerability discovered by Farid Narimanov in WordPress Plugin Extra Product Options Builder for WooCommerce versions 1.2.176...

CVE-2026-73181

Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce 7.6 versions...

CVE-2026-73181

Extra Product Options & Add-Ons for WooCommerce plugin versions below 7.6 allow unauthenticated attackers to download arbitrary files, exposing sensitive data with CVSS 7.5 (HIGH). PatchStack reports the flaw; no exploit code is provided. Upgrade to version 7.6 or later to remediate. Exploitation...