CVE-2026-110771 Shopizer through 3.2.5 Authorization Bypass via Product Review customerId

Shopizer through 3.2.5 contains an authorization bypass vulnerability that allows authenticated customers to post reviews as other customers by supplying a customerId field. Attackers can send crafted requests to POST /api/v1/auth/products/id/reviews to publish reviews and ratings attributed to...

WordPress Verified Reviews (Avis Vérifiés) plugin <= 2.4.6 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by nthng in WordPress Plugin Verified Reviews Avis Vérifiés versions = 2.4.6...

CVE-2026-94377

The Verified Reviews Avis Vérifiés plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moderation' parameter in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

CVE-2026-94377 Verified Reviews (Avis Vérifiés) <= 2.4.6 - Unauthenticated Stored Cross-Site Scripting via 'moderation' Parameter (discussion.commentaire)

The Verified Reviews Avis Vérifiés plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moderation' parameter in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

CVE-2026-94377

The Verified Reviews (Avis Vérifiés) plugin for WordPress (versions up to and including 2.4.6 ) is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) . The flaw exists in the 'moderation' parameter within discussion.commentaire due to insufficient input sanitization and output escapi...

EUVD-2026-100792

The Verified Reviews Avis Vérifiés plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moderation' parameter in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

PT-2026-113622

The Verified Reviews Avis Vérifiés plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moderation' parameter in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

CVE-2026-108724

Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmoderated and rejected product reviews because the AcceptedExtension filter is not applied to the item operation. Attackers can enumerate sequential ids on GET...

CVE-2026-108724 Sylius through 2.3.0 Authorization Bypass via Shop API Product-Review Endpoint

Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmoderated and rejected product reviews because the AcceptedExtension filter is not applied to the item operation. Attackers can enumerate sequential ids on GET...

CVE-2026-108724

Versions of Sylius through 2.3.0 are vulnerable to an authorization bypass in the Shop API. The issue stems from the AcceptedExtension filter not being applied to the item operation, allowing unauthenticated attackers to bypass merchant moderation. By enumerating sequential IDs on the GET /api/v2...

CVE-2026-108724 Sylius through 2.3.0 Authorization Bypass via Shop API Product-Review Endpoint

Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmoderated and rejected product reviews because the AcceptedExtension filter is not applied to the item operation. Attackers can enumerate sequential ids on GET...

EUVD-2026-96890

Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmoderated and rejected product reviews because the AcceptedExtension filter is not applied to the item operation. Attackers can enumerate sequential ids on GET...

publications

Publications from Trail of Bits Publications from Trail of Bits Academic Papers White Papers Guides and Handbooks Conference Presentations Automated bug finding and exploitation Blockchain Compilers Cryptography Engineering Education Infrastructure Machine Learning Mobile security Programming Sid...

PT-2026-110127

Name of the Vulnerable Software and Affected Versions Sylius versions prior to 2.3.1 Description An authorization bypass allows unauthenticated attackers to read product reviews that have been rejected or are awaiting moderation. This occurs because the AcceptedExtension filter is not applied to...

CVE-2026-108724: Authorization Bypass Through User-Controlled Key

Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmoderated and rejected product reviews because the AcceptedExtension filter is not applied to the item operation. Attackers can enumerate sequential ids on GET...

CVE-2026-100161

The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'wcprimageuploadid' parameter in all versions up to, and including, 1.2.30 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-100161 Photo Reviews for WooCommerce <= 1.2.30 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'wcpr_image_upload_id' Parameter

The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'wcprimageuploadid' parameter in all versions up to, and including, 1.2.30 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-100161

The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting (XSS) in all versions up to and including 1.2.30 . The root cause is insufficient input sanitization and output escaping of the wcpr_image_upload_id parameter. Because the wcpr_image_uplo...

EUVD-2026-96216

The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'wcprimageuploadid' parameter in all versions up to, and including, 1.2.30 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-100161: Improper Neutralization of Input During Web Page Generation

The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'wcprimageuploadid' parameter in all versions up to, and including, 1.2.30 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...