WordPress MultiVendorX plugin < 5.0.11 - Store Owner+ Cross-Store Commission Data Disclosure via commissions REST Endpoint vulnerability

Store Owner+ Cross-Store Commission Data Disclosure via commissions REST Endpoint vulnerability discovered by ryan fabella in WordPress Plugin MultiVendorX versions 5.0.11...

WordPress Content Protector (Passster) plugin < 4.3.6 - Unauthenticated Non-Public Post Content Disclosure via Captcha REST Endpoint vulnerability

Unauthenticated Non-Public Post Content Disclosure via Captcha REST Endpoint vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Passster versions 4.3.6...

CVE-2026-78125

The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthenticated attackers to disclose the payment status of arbitrary orders by enumerating order identifiers...

CVE-2026-78139

The Notifima WordPress plugin before 3.1.4 does not verify that the caller owns the subscription being modified on one of its REST endpoints in all versions up to, and including, 3.1.3, allowing authenticated attackers with Subscriber-level access to unsubscribe arbitrary customers from product...

CVE-2026-16568

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not verify that the requesting user owns the customer profile being queried through one of its REST endpoints, allowing any authenticated user e.g. a customer/subscriber to...

CVE-2026-16569

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not check the user's capabilities before allowing a stock-update operation through one of its REST endpoints, allowing any authenticated user, such as a customer or subscriber...

EUVD-2026-66881

The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthenticated attackers to disclose the payment status of arbitrary orders by enumerating order identifiers...

EUVD-2026-66884

The Notifima WordPress plugin before 3.1.4 does not verify that the caller owns the subscription being modified on one of its REST endpoints in all versions up to, and including, 3.1.3, allowing authenticated attackers with Subscriber-level access to unsubscribe arbitrary customers from product...

CVE-2026-78125 LearnPress – Sepay Payment < 4.0.3 - Unauthenticated Order Status Disclosure

The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthenticated attackers to disclose the payment status of arbitrary orders by enumerating order identifiers...

CVE-2026-78125

The LearnPress – Sepay Payment WordPress plugin before version 4.0.3 (all versions up to and including 4.0.2) fails to perform any authorization check on one of its REST endpoints. This allows unauthenticated attackers to enumerate order identifiers and disclose the payment status of arbitrary or...

CVE-2026-16569 ShopApper <= 0.4.62 - Subscriber+ Arbitrary Product Stock Update

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not check the user's capabilities before allowing a stock-update operation through one of its REST endpoints, allowing any authenticated user, such as a customer or subscriber...

CVE-2026-16568 ShopApper <= 0.4.62 - Subscriber+ Customer Data Disclosure via IDOR

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not verify that the requesting user owns the customer profile being queried through one of its REST endpoints, allowing any authenticated user e.g. a customer/subscriber to...

EUVD-2026-66872

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not check the user's capabilities before allowing a stock-update operation through one of its REST endpoints, allowing any authenticated user, such as a customer or subscriber...

CVE-2026-16569

ShopApper (The Mobile App for WooCommerce) WordPress plugin versions through 0.4.62 (Patchstack reports affected up to 0.4.66) lack a capability check on a REST endpoint that handles stock-update operations. This allows any authenticated user with Subscriber role or higher to modify the stock qua...

EUVD-2026-66871

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not verify that the requesting user owns the customer profile being queried through one of its REST endpoints, allowing any authenticated user e.g. a customer/subscriber to...

CVE-2026-16568

This is an IDOR (Insecure Direct Object Reference) vulnerability in The Mobile App for WooCommerce: ShopApper WordPress plugin. A REST endpoint fails to verify that the requesting user owns the customer profile being queried, allowing any authenticated Subscriber+ user to retrieve other users' pe...

PT-2026-82388

Name of the Vulnerable Software and Affected Versions ShopApper Mobile App Builder Service for WooCommerce WordPress plugin versions prior to 0.4.63 Description The plugin fails to verify user permissions before performing stock-update operations via a REST endpoint. This allows any authenticated...

CVE-2026-76063

The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wfpfeaturedvideourl' parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-76063

The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wfp_featured_video_url parameter in all versions up to and including 1.8.1 . The root cause is insufficient input sanitization and output escaping. The REST endpoint used ...

CVE-2026-76063 FundEngine <= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wfp_featured_video_url' Parameter

The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wfpfeaturedvideourl' parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for...