CVE-2026-1937

🔴 Vulnerability Overview CVE-2026-1937 — Missing Authorization → Arbitrary Options Update → Privilege Escalation Field| Details ---|--- CVE ID| CVE-2026-1937 Severity| HIGH — CVSS v3.1 Score: 7.2 Vector| CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CNA| Wordfence Researcher| Daniel Basta whizzu —...

CVE-2026-62130

Shop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency = 5.5.8 versions...

CVE-2026-62130 WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.5.8 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency = 5.5.8 versions...

EUVD-2026-96512

Shop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency = 5.5.8 versions...

CVE-2026-62130

The WordPress WooCommerce Multilingual & Multicurrency plugin in versions

EUVD-2026-93272

Shop Manager Privilege Escalation in Challan = 3.7.88 versions...

CVE-2026-39765 WordPress Challan plugin <= 3.7.88 - Privilege Escalation vulnerability

Shop Manager Privilege Escalation in Challan = 3.7.88 versions...

CVE-2026-39765 WordPress Challan plugin <= 3.7.88 - Privilege Escalation vulnerability

Shop Manager Privilege Escalation in Challan = 3.7.88 versions...

CVE-2026-39765

The Challan WordPress plugin (versions

PT-2026-106437

Name of the Vulnerable Software and Affected Versions Challan versions prior to 3.7.89 Description A privilege escalation issue exists that allows a user with Shop Manager permissions to elevate their privileges within the system. Recommendations Update to a version newer than 3.7.88...

CVE-2026-13718

The Tabs Responsive WordPress plugin through 2.5 does not sanitize the content of WooCommerce product tabs before storing and rendering it, allowing a shop manager to store JavaScript that executes when any user, including an administrator, views the product page...

EUVD-2026-91190

The Tabs Responsive WordPress plugin through 2.5 does not sanitize the content of WooCommerce product tabs before storing and rendering it, allowing a shop manager to store JavaScript that executes when any user, including an administrator, views the product page...

CVE-2026-13718

The Tabs Responsive WordPress plugin, affecting versions through 2.5 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to sanitize the content of WooCommerce product tabs before it is stored and subsequently rendered. This flaw allows an attacker with shop manager...

CVE-2026-13718 Tabs Responsive <= 2.5 - Shop Manager+ Stored XSS via WooCommerce Product Tab Content

The Tabs Responsive WordPress plugin through 2.5 does not sanitize the content of WooCommerce product tabs before storing and rendering it, allowing a shop manager to store JavaScript that executes when any user, including an administrator, views the product page...

CVE-2026-13718 Tabs Responsive <= 2.5 - Shop Manager+ Stored XSS via WooCommerce Product Tab Content

The Tabs Responsive WordPress plugin through 2.5 does not sanitize the content of WooCommerce product tabs before storing and rendering it, allowing a shop manager to store JavaScript that executes when any user, including an administrator, views the product page...

CVE-2026-13718: Improper Neutralization of Input During Web Page Generation

The Tabs Responsive WordPress plugin through 2.5 does not sanitize the content of WooCommerce product tabs before storing and rendering it, allowing a shop manager to store JavaScript that executes when any user, including an administrator, views the product page...

PT-2026-104084

Name of the Vulnerable Software and Affected Versions Tabs Responsive WordPress plugin versions prior to 2.6 Description The plugin fails to sanitize the content of WooCommerce product tabs before storing and rendering it. This allows a user with shop manager privileges to inject malicious...

EUVD-2025-209823

The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the wpcbmbestseller shortcode in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-102392

The Extra Product Options For WooCommerce | Custom Product Addons and Fields plugin for WordPress is vulnerable to a PHP Object Injection vulnerability in versions

CVE-2026-102392 WordPress Extra Product Options For WooCommerce | Custom Product Addons and Fields plugin <= 3.3.8 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields = 3.3.8 versions...