25 matches found
CVE-2026-118540
Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.2.0...
DRUPAL-CONTRIB-2026-259
This module enables you to sell goods and services to customers through a shopping cart and checkout form. The module doesn't sufficiently restrict the product variations returned by entity queries to the variations the current user can view. When the core JSON:API module is enabled, a visitor ca...
PT-2026-130570
This module enables you to sell goods and services to customers through a shopping cart and checkout form. When Drupal Commerce is used with the JSON:API module, it is possible for unpublished product variations to be accessible to users without permission. This vulnerability is mitigated by only...
Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-255
This module enables you to sell goods and services to customers through a shopping cart and checkout form. When Drupal Commerce is used with the JSON:API module, it is possible for unpublished product variations to be accessible to users without permission. This vulnerability is mitigated by only...
CVE-2026-86850 SKU Error Fixer for WooCommerce <= 1.0 - Unauthenticated Orphaned Product Variation Deletion
The SKU Error Fixer for WooCommerce WordPress plugin through 1.0 does not perform any capability or nonce checks on two of its AJAX actions, which are also available to unauthenticated users, allowing them to permanently delete product variations it classifies as obsolete, and to disclose those...
CVE-2026-81282
Subscriber Cross Site Scripting XSS in Product Variations Swatches for WooCommerce = 1.1.18 versions...
EUVD-2026-70595
Subscriber Cross Site Scripting XSS in Product Variations Swatches for WooCommerce = 1.1.18 versions...
CVE-2026-81282 WordPress Product Variations Swatches for WooCommerce plugin <= 1.1.18 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting XSS in Product Variations Swatches for WooCommerce = 1.1.18 versions...
CVE-2026-81282 WordPress Product Variations Swatches for WooCommerce plugin <= 1.1.18 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting XSS in Product Variations Swatches for WooCommerce = 1.1.18 versions...
CVE-2026-81282
Product Variations Swatches for WooCommerce (WordPress plugin) versions
CVE-2026-81282: Improper Neutralization of Input During Web Page Generation
Subscriber Cross Site Scripting XSS in Product Variations Swatches for WooCommerce = 1.1.18 versions...
PT-2026-85087
Subscriber Cross Site Scripting XSS in Product Variations Swatches for WooCommerce = 1.1.18 versions...
WordPress Product Variations Swatches for WooCommerce plugin <= 1.1.18 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Roll in WordPress Plugin Product Variations Swatches for WooCommerce versions = 1.1.18...
CVE-2026-81428
The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when saving product variations, allowing authenticated users with the vendor role to modify product variations belonging to other vendors, and to change the status and title of arbitra...
EUVD-2026-69855
The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when saving product variations, allowing authenticated users with the vendor role to modify product variations belonging to other vendors, and to change the status and title of arbitra...
CVE-2026-81428 WC Vendors < 2.7.2.1 - Vendor+ Cross-Vendor Product and Arbitrary Post Modification via IDOR
The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when saving product variations, allowing authenticated users with the vendor role to modify product variations belonging to other vendors, and to change the status and title of arbitra...
CVE-2026-81428 WC Vendors < 2.7.2.1 - Vendor+ Cross-Vendor Product and Arbitrary Post Modification via IDOR
The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when saving product variations, allowing authenticated users with the vendor role to modify product variations belonging to other vendors, and to change the status and title of arbitra...
PT-2026-84635
The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when saving product variations, allowing authenticated users with the vendor role to modify product variations belonging to other vendors, and to change the status and title of arbitra...
CVE-2026-81428: Authorization Bypass Through User-Controlled Key
The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when saving product variations, allowing authenticated users with the vendor role to modify product variations belonging to other vendors, and to change the status and title of arbitra...