CVE-2026-16568

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not verify that the requesting user owns the customer profile being queried through one of its REST endpoints, allowing any authenticated user e.g. a customer/subscriber to...

CVE-2026-16569

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not check the user's capabilities before allowing a stock-update operation through one of its REST endpoints, allowing any authenticated user, such as a customer or subscriber...

CVE-2026-16569 ShopApper <= 0.4.62 - Subscriber+ Arbitrary Product Stock Update

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not check the user's capabilities before allowing a stock-update operation through one of its REST endpoints, allowing any authenticated user, such as a customer or subscriber...

CVE-2026-16569

ShopApper (The Mobile App for WooCommerce) WordPress plugin versions through 0.4.62 (Patchstack reports affected up to 0.4.66) lack a capability check on a REST endpoint that handles stock-update operations. This allows any authenticated user with Subscriber role or higher to modify the stock qua...

CVE-2026-16568 ShopApper <= 0.4.62 - Subscriber+ Customer Data Disclosure via IDOR

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not verify that the requesting user owns the customer profile being queried through one of its REST endpoints, allowing any authenticated user e.g. a customer/subscriber to...

EUVD-2026-66872

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not check the user's capabilities before allowing a stock-update operation through one of its REST endpoints, allowing any authenticated user, such as a customer or subscriber...

CVE-2026-16568

This is an IDOR (Insecure Direct Object Reference) vulnerability in The Mobile App for WooCommerce: ShopApper WordPress plugin. A REST endpoint fails to verify that the requesting user owns the customer profile being queried, allowing any authenticated Subscriber+ user to retrieve other users' pe...

EUVD-2026-66871

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not verify that the requesting user owns the customer profile being queried through one of its REST endpoints, allowing any authenticated user e.g. a customer/subscriber to...

EUVD-2025-11717

Malicious code in bioql PyPI...

CVE-2025-32638

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in weptile Mobile App for WooCommerce mobile-app-for-woocommerce allows Stored XSS.This issue affects Mobile App for WooCommerce: from n/a through = 0.4.61...

CVE-2025-32638

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in weptile Mobile App for WooCommerce mobile-app-for-woocommerce allows Stored XSS.This issue affects Mobile App for WooCommerce: from n/a through = 0.4.61...

CVE-2025-32638

CVE-2025-32638 describes a Stored XSS in the WordPress plugin ShopApper (Mobile App for WooCommerce). The initial description states the vulnerability affects ShopApper versions n/a–0.4.39 and is caused by improper input neutralization during web page generation. Connected data indicate a patch e...

CVE-2025-32638 WordPress ShopApper plugin <= 0.4.61 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in weptile Mobile App for WooCommerce mobile-app-for-woocommerce allows Stored XSS.This issue affects Mobile App for WooCommerce: from n/a through = 0.4.61...

CVE-2025-32638 WordPress ShopApper plugin <= 0.4.61 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in weptile Mobile App for WooCommerce mobile-app-for-woocommerce allows Stored XSS.This issue affects Mobile App for WooCommerce: from n/a through = 0.4.61...

WordPress plugin ShopApper 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...

PT-2025-17151 · Weptile · Weptile Shopapper

Name of the Vulnerable Software and Affected Versions: weptile ShopApper versions 0.4.39 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Stored XSS. This means that an attacker can...

WordPress ShopApper plugin <= 0.4.59 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by stealthcopter in WordPress Plugin Mobile App for WooCommerce versions = 0.4.59...