Multiple Shipping Address Woocommerce < 2.0 - SQL Injection

The Multiple Shipping Address Woocommerce plugin before 2.0 does not properly sanitize and escape numerous parameters before using them in SQL statements via some AJAX actions available to unauthenticated users, leading to unauthenticated SQL injections. id: CVE-2022-0783 info: name: Multiple...

Shopping privilege escalation through missing authorization in Settings components

Summary Four Livewire components in the Settings area expose destructive Filament actions delete / edit that perform no server-side authorization. Any authenticated user who can reach the Settings pages — i.e. holding only the coarse accesssetting permission, without being an admin and without an...

PT-2026-90542

Summary Four Livewire components in the Settings area expose destructive Filament actions delete / edit that perform no server-side authorization. Any authenticated user who can reach the Settings pages — i.e. holding only the coarse access setting permission, without being an admin and without a...

CVE-2026-84836

Subscriber Insecure Direct Object References IDOR in WC Ukraine Shipping = 1.22.3 versions...

CVE-2026-84836 WordPress WC Ukraine Shipping plugin <= 1.22.3 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References IDOR in WC Ukraine Shipping = 1.22.3 versions...

CVE-2026-84836

WC Ukraine Shipping is a WordPress plugin affected by an Insecure Direct Object References (IDOR) vulnerability in versions 1.22.3 and earlier . The flaw allows a low-privilege user (Subscriber level) to access restricted objects, resulting in high confidentiality impact and low integrity impact,...

EUVD-2026-70568

Subscriber Insecure Direct Object References IDOR in WC Ukraine Shipping = 1.22.3 versions...

WordPress WC Ukraine Shipping plugin <= 1.22.5 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin WC Ukraine Shipping versions = 1.22.5...

PT-2026-85120

Subscriber Insecure Direct Object References IDOR in WC Ukraine Shipping = 1.22.3 versions...

EUVD-2026-61510

Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Shipping...

CVE-2026-66655 WordPress MultiParcels Shipping For WooCommerce plugin <= 1.30.36 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in MultiParcels Shipping For WooCommerce = 1.30.36 versions...

EUVD-2026-57894

Unauthenticated Cross Site Scripting XSS in MultiParcels Shipping For WooCommerce = 1.30.36 versions...

CVE-2026-66655

Unauthenticated Cross Site Scripting XSS in MultiParcels Shipping For WooCommerce = 1.30.36 versions...

CVE-2026-19088

The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout...

CVE-2026-16993

The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not protect its shipping-label storage directory with server-independent access control, relying only on an Apache .htaccess file, so on a web server that does not honor .htaccess such as nginx an unauthenticated visitor...

CVE-2026-16981

The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not perform any authorization check no capability, nonce, login, or ownership check on one of its shipping-label download endpoints, so an unauthenticated attacker can enumerate sequential ids and download every stored...

EUVD-2026-53114

The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not protect its shipping-label storage directory with server-independent access control, relying only on an Apache .htaccess file, so on a web server that does not honor .htaccess such as nginx an unauthenticated visitor...

CVE-2026-16981 DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Download via IDOR

The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not perform any authorization check no capability, nonce, login, or ownership check on one of its shipping-label download endpoints, so an unauthenticated attacker can enumerate sequential ids and download every stored...

EUVD-2026-53113

The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not perform any authorization check no capability, nonce, login, or ownership check on one of its shipping-label download endpoints, so an unauthenticated attacker can enumerate sequential ids and download every stored...

CVE-2026-16993

The CVE-2026-16993 entry concerns the DHL Shipping Germany for WooCommerce WordPress plugin (pre-4.0.1). The root cause is that the plugin’s shipping-label storage directory is not protected by server-independent access control and relies solely on an Apache .htaccess file. On servers that do not...