CVE-2026-120563

The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 5.5.7. This is due to insufficient input validation on the currency exchange rate parameter in the savecurrency AJAX handler, which lacks capability...

EUVD-2026-115667

The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 5.5.7. This is due to insufficient input validation on the currency exchange rate parameter in the savecurrency AJAX handler, which lacks capability...

EUVD-2026-115663

The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the trackingprovider parameter of the POST /wp-json/wc-ast/v3/orders//shipment-trackings REST endpoint in all versions up to, and including, 3.9. This is due to insufficient escaping on the...

CVE-2026-109988 Product Addons for Woocommerce <= 3.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'type' Field Parameter

The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fieldssectionfieldsrowcoltype' parameter in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping. This...

CVE-2026-109988

The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.1.8 . The root cause is insufficient input sanitization and output escaping within the fields[section][fields][row]...

CVE-2026-109988 Product Addons for Woocommerce <= 3.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'type' Field Parameter

The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fieldssectionfieldsrowcoltype' parameter in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping. This...

EUVD-2026-111604

The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fieldssectionfieldsrowcoltype' parameter in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping. This...

PT-2026-127870

The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fieldssectionfieldsrowcoltype' parameter in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping. This...

CVE-2026-109988: acowebs Product Addons for Woocommerce – Product Options with Custom Fields: The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Stored…

The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fieldssectionfieldsrowcoltype' parameter in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping. This...

CVE-2026-15095: Improper Limitation of a Pathname to a Restricted Directory

The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.6.43 via the 'provider' parameter. This makes it possible for authenticated attackers, with shop...

PT-2026-68555

Name of the Vulnerable Software and Affected Versions Order Delivery Date for WooCommerce versions prior to 4.6.1 Description An issue exists in the Order Delivery Date for WooCommerce plugin for WordPress that allows authenticated attackers with Shop Manager-level access or higher to elevate the...

CVE-2026-11973: Improper Neutralization of Special Elements used in an SQL Command

The WP-Lister Lite for eBay plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2026-15324: Improper Neutralization of Input During Web Page Generation

The SysBasics Customize My Account for WooCommerce – Live My Account Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rowtype' parameter in all versions up to, and including, 4.4.14 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-10104: Improper Neutralization of Input During Web Page Generation

The Product Video Gallery for Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via customthumbnail Parameter in all versions up to, and including, 1.5.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-12137: Improper Neutralization of Input During Web Page Generation

The SysBasics Customize My Account for WooCommerce – Dashboard, Endpoints, Avatar & Menu Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 4.3.6 due to insufficient input sanitization and output escaping. Thi...

CVE-2025-14767: Improper Neutralization of Input During Web Page Generation

The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the wpcbmbestseller shortcode in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2025-1659

Name of the Vulnerable Software and Affected Versions Custom Product Tabs for WooCommerce plugin for WordPress versions up to, and including, 1.8.5 Description The issue concerns a PHP Object Injection vulnerability via deserialization of untrusted input in the yikes woo products tabs post meta...

CVE-2024-9927

The WooCommerce Order Proposal plugin for WordPress is vulnerable to privilege escalation via order proposal in all versions up to and including 2.0.5. This is due to the improper implementation of allowpaymentwithoutlogin function. This makes it possible for authenticated attackers, with Shop...

WooCommerce Multilingual & Multicurrency with WPML < 5.3.4 - Shop Manager+ SQL Injection

Description The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 5.3.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...

WooCommerce Multilingual & Multicurrency with WPML < 5.3.4 - Shop Manager+ SQL Injection

Description The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 5.3.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...