554 matches found
CVE-2026-1937
🔴 Vulnerability Overview CVE-2026-1937 — Missing Authorization → Arbitrary Options Update → Privilege Escalation Field| Details ---|--- CVE ID| CVE-2026-1937 Severity| HIGH — CVSS v3.1 Score: 7.2 Vector| CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CNA| Wordfence Researcher| Daniel Basta whizzu —...
CVE-2026-123122
The Checkout Files Upload for WooCommerce WordPress plugin (versions before 2.4.1 ) is vulnerable to unauthenticated stored XSS . The root cause is a failure to properly verify that files uploaded during checkout match allowed image types. The plugin serves these uploads inline using their detect...
CVE-2026-87964
The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 8.0.26. This is due to insufficient sanitization of the feedConfigCustom2 parameter — only wpunslash is...
EUVD-2026-118171
The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 8.0.26. This is due to insufficient sanitization of the feedConfigCustom2 parameter — only wpunslash is...
CVE-2026-87964 Product Feed Manager for WooCommerce <= 8.0.26 - Authenticated (Shop Manager+) PHP Code Injection via eval() via 'feedConfigCustom2' Parameter
The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 8.0.26. This is due to insufficient sanitization of the feedConfigCustom2 parameter — only wpunslash is...
CVE-2026-87964
The Product Feed Manager for WooCommerce – CTX Feed WordPress plugin (versions
WordPress Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels plugin <= 8.0.26 - Authenticated (Shop Manager+) PHP Code Injection vulnerability
Authenticated Shop Manager+ PHP Code Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin CTX Feed versions = 8.0.26...
CVE-2026-120558
The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the trackingprovider parameter of the POST /wp-json/wc-ast/v3/orders//shipment-trackings REST endpoint in all versions up to, and including, 3.9. This is due to insufficient escaping on the...
CVE-2026-120563
The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 5.5.7. This is due to insufficient input validation on the currency exchange rate parameter in the savecurrency AJAX handler, which lacks capability...
WordPress WPML Multilingual & Multicurrency for WooCommerce plugin <= 5.5.7 - Authenticated (Shop Manager+) SQL Injection vulnerability
Authenticated Shop Manager+ SQL Injection vulnerability discovered by Muni Nitish Kumar Yaddala Stranger825 in WordPress Plugin WooCommerce Multilingual & Multicurrency versions = 5.5.7...
CVE-2026-120563 WPML Multilingual & Multicurrency for WooCommerce <= 5.5.7 - Authenticated (Shop Manager+) SQL Injection via Exchange Rate Field
The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 5.5.7. This is due to insufficient input validation on the currency exchange rate parameter in the savecurrency AJAX handler, which lacks capability...
EUVD-2026-115667
The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 5.5.7. This is due to insufficient input validation on the currency exchange rate parameter in the savecurrency AJAX handler, which lacks capability...
CVE-2026-120563
The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to SQL Injection in versions up to and including 5.5.7 . The root cause is insufficient input validation on the currency exchange rate parameter within the save_currency() AJAX handler, which lacks proper ca...
CVE-2026-120558 Advanced Shipment Tracking for WooCommerce <= 3.9 - Authenticated (Shop Manager+) SQL Injection via 'tracking_provider' Parameter
The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the trackingprovider parameter of the POST /wp-json/wc-ast/v3/orders//shipment-trackings REST endpoint in all versions up to, and including, 3.9. This is due to insufficient escaping on the...
CVE-2026-120558
The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 3.9 . The flaw exists in the WC_Advanced_Shipment_Tracking_Admin::get_provider_slug_from_name() method due to insufficient escaping and improper use of $wpdb->...
EUVD-2026-115663
The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the trackingprovider parameter of the POST /wp-json/wc-ast/v3/orders//shipment-trackings REST endpoint in all versions up to, and including, 3.9. This is due to insufficient escaping on the...
CVE-2026-118089 WordPress Product Feed Manager plugin <= 7.14.1 - PHP Object Injection vulnerability
Shop manager PHP Object Injection in Product Feed Manager = 7.14.1 versions...
CVE-2026-118089
The Product Feed Manager plugin for WordPress, versions
