321 matches found
CVE-2026-75959
The GoPay for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'logtablefilter' parameter in all versions up to, and including, 1.0.36 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This make...
CVE-2026-16777
The Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.8.0 via the 'filename' parameter parameter. This makes it possible for authenticated attackers, with shop...
EUVD-2026-82758
The Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.8.0 via the 'filename' parameter parameter. This makes it possible for authenticated attackers, with shop...
CVE-2026-1937
🔴 Resumen de la Vulnerabilidad CVE-2026-1937 — Autorización faltante → Actualización arbitraria de opciones → Escalada de privilegios Descripción: El plugin YayMail – WooCommerce Email Customizer para WordPress es vulnerable a la modificación no autorizada de datos que conduce a la escalada de...
WordPress Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers plugin <= 2.8.0 - Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read and Arbitrary File Deletion vulnerability
Authenticated Shop Manager+ Path Traversal to Arbitrary File Read and Arbitrary File Deletion vulnerability discovered by Wordfence PRISM in WordPress Plugin Store Exporter versions = 2.8.0...
CVE-2026-66628
Shop manager SQL Injection in WP-Lister Lite for eBay = 3.8.11 versions...
EUVD-2026-81509
Shop manager SQL Injection in WP-Lister Lite for eBay = 3.8.11 versions...
CVE-2026-66628
A SQL Injection vulnerability was identified in the shop manager functionality of the WordPress plugin WP-Lister Lite for eBay , affecting versions
EUVD-2026-74607
The WP Crowdfunding plugin for WordPress is vulnerable to generic SQL Injection via 'wpneoreward' Post Meta in all versions up to, and including, 2.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...
WordPress WP Crowdfunding plugin <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection vulnerability
Authenticated Shop Manager+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Crowdfunding versions = 2.2.1...
CVE-2026-77693
The Order Tip for WooCommerce WordPress plugin before 1.6.0 does not check the capability of the user requesting a file deletion, nor does it restrict which path may be deleted, allowing users with the Shop Manager role and above to delete arbitrary files on the server, which could lead to the si...
CVE-2026-77693
The Order Tip for WooCommerce WordPress plugin (versions before 1.6.0 ) contains an arbitrary file deletion vulnerability in the delete_exported_csv_file_ajax function. The plugin fails to verify the requesting user's capability or restrict the file path, allowing authenticated users with the Sho...
CVE-2026-77693 Order Tip for WooCommerce < 1.6.0 - Shop Manager+ Arbitrary File Deletion via delete_exported_csv_file_ajax
The Order Tip for WooCommerce WordPress plugin before 1.6.0 does not check the capability of the user requesting a file deletion, nor does it restrict which path may be deleted, allowing users with the Shop Manager role and above to delete arbitrary files on the server, which could lead to the si...
EUVD-2026-65462
The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9.4. This is due to the rumimporter function being registered on the WordPress core importstart action hook with ...
CVE-2026-75971
The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin is vulnerable to privilege escalation in versions up to and including 4.9.4 . The root cause is the rum_importer() function registered on the import_start action hook without a plugin-owned capability check or allowlist filtering...
CVE-2026-75971 ShopEngine Elementor WooCommerce Builder Addon <= 4.9.4 - Authenticated (Shop Manager+) Privilege Escalation to WXR Import '<wp_option>' Nodes
The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9.4. This is due to the rumimporter function being registered on the WordPress core importstart action hook with ...
CVE-2026-16576
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly check user capabilities on some of its admin REST API routes, checking only for a WooCommerce management capability instead of the Dokan: AI Powered WooCommerce Multivendor...
CVE-2026-16576 Dokan < 5.0.14 - Shop Manager+ Arbitrary Plugin Installation/Activation via REST API
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly check user capabilities on some of its admin REST API routes, checking only for a WooCommerce management capability instead of the Dokan: AI Powered WooCommerce Multivendor...
CVE-2026-16576
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 contains an improper access control flaw in its admin REST API routes. The affected endpoints check only for a WooCommerce management capability rather than the required Dokan-installation capability...