Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Settings
Sign in
🔥 Daily Hot!
💪🏽 CPE Enhanced Advisories
🕶 Shadow Exploits
🕵🏼 Vulners CPE
🔐 Security news
💻 Exploit updates
📑 Blogs review
🐧 Linux vulnerabilities
🐞 Bugbounty
🤖 AI High Score
📰 CVE Feed
show all

45 matches found

NVD
NVD•added 2026/08/13 6:17 a.m.•11 views

CVE-2026-19088

The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout...

5.4CVSS0.00099EPSS
SaveExploits0References1
Cvelist
Cvelist•added 2026/08/13 6:00 a.m.•36 views

CVE-2026-19088 ShopEngine < 4.9.3 - Customer PII Disclosure via Forced Authentication

The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout...

0.00099EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB•added 2026/08/13 6:00 a.m.•6 views

CVE-2026-19088

The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout...

5.3AI score0.00099EPSS
SaveExploits0References1
CVE
CVE•added 2026/08/13 6:00 a.m.•34 views

CVE-2026-19088

The CVE-2026-19088 affects the ShopEngine Elementor WooCommerce Builder Addon for WordPress (older than 4.9.3). The issue is an CSRF vulnerability on an authentication endpoint, which can allow an attacker to log a victim into an attacker-controlled account. As a consequence, billing and shipping...

5.4CVSS5.3AI score0.00099EPSS
SaveExploits0References1
EUVD
EUVD•added 2026/08/13 6:00 a.m.•11 views

EUVD-2026-57729

The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout...

5.4CVSS5.3AI score0.00099EPSS
SaveExploits0References1
NVD
NVD•added 2025/12/03 1:16 p.m.•16 views

CVE-2025-12358

The ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.8.5. This is due to missing nonce validation on the "postaddtolist" function as well as an incorrect permissions callback in the "Api/init"...

4.3CVSS0.00122EPSS
SaveExploits0References2
EUVD
EUVD•added 2025/12/03 12:29 p.m.•9 views

EUVD-2025-200980

The ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.8.5. This is due to missing nonce validation on the "postaddtolist" function as well as an incorrect permissions callback in the "Api/init"...

4.3CVSS5AI score0.00122EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment•added 2025/12/03 12:29 p.m.•7 views

CVE-2025-12358 ShopEngine <= 4.8.5 - Cross-Site Request Forgery to Wishlist Manipulation

The ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.8.5. This is due to missing nonce validation on the "postaddtolist" function as well as an incorrect permissions callback in the "Api/init"...

4.3CVSS5.1AI score0.00122EPSS
SaveExploits0References2
Cvelist
Cvelist•added 2025/12/03 12:29 p.m.•33 views

CVE-2025-12358 ShopEngine <= 4.8.5 - Cross-Site Request Forgery to Wishlist Manipulation

The ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.8.5. This is due to missing nonce validation on the "postaddtolist" function as well as an incorrect permissions callback in the "Api/init"...

4.3CVSS0.00122EPSS
SaveExploits0References2
CVE
CVE•added 2025/12/03 12:29 p.m.•32 views

CVE-2025-12358

CVE-2025-12358 concerns ShopEngine Elementor WooCommerce Builder Addon for WordPress. Wordfence and related feeds describe a Cross-Site Request Forgery vulnerability in all versions up to 4.8.5, caused by missing nonce validation on the post_add_to_list function and an incorrect permissions callb...

4.3CVSS5.1AI score0.00122EPSS
SaveExploits0References2
Patchstack
Patchstack•added 2025/12/03 1:31 a.m.•11 views

WordPress ShopEngine plugin <= 4.8.5 - Cross-Site Request Forgery to Wishlist Manipulation vulnerability

Cross-Site Request Forgery to Wishlist Manipulation vulnerability discovered by Adrian Lukita in WordPress Plugin ShopEngine versions = 4.8.5...

4.3CVSS6.7AI score0.00122EPSS
SaveExploits0References1Affected Software1
CNNVD
CNNVD•added 2025/12/03 12:00 a.m.•11 views

WordPress plugin ShopEngine Elementor WooCommerce Builder Addon 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host a personal blog site on a PHP and MySQL based server.WordPress plugin is an application plugin. A cross-site request...

4.3CVSS6.3AI score0.00122EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies•added 2025/12/03 12:00 a.m.•13 views

PT-2025-48803

The ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.8.5. This is due to missing nonce validation on the "post add to list" function as well as an incorrect permissions callback in the "Api/init...

4.3CVSS5.5AI score0.00122EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE•added 2025/10/26 6:36 a.m.•16 views

CVE-2025-11888

The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient capability check on the postdeactive function and postactivate function in all versions up to, and including, 4.8.4...

2.7CVSS5.5AI score0.00208EPSS
SaveExploits0References1
CNNVD
CNNVD•added 2025/10/26 12:00 a.m.•9 views

WordPress plugin ShopEngine Elementor WooCommerce Builder Addon 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plug-in. A security...

2.7CVSS6.2AI score0.00208EPSS
SaveExploits0References1
NVD
NVD•added 2025/10/25 6:15 a.m.•10 views

CVE-2025-11888

The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient capability check on the postdeactive function and postactivate function in all versions up to, and including, 4.8.4...

2.7CVSS0.00208EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment•added 2025/10/25 5:31 a.m.•8 views

CVE-2025-11888 ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution <= 4.8.4 - Incorrect Authorization to Authenticated (Editor+) License Status Update

The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient capability check on the postdeactive function and postactivate function in all versions up to, and including, 4.8.4...

2.7CVSS5.1AI score0.00208EPSS
SaveExploits0References2
CVE
CVE•added 2025/10/25 5:31 a.m.•27 views

CVE-2025-11888

The CVE-2025-11888 entry concerns the WordPress plugin ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution. Affected versions are

2.7CVSS5.1AI score0.00208EPSS
SaveExploits0References2
EUVD
EUVD•added 2025/10/25 5:31 a.m.•17 views

EUVD-2025-35906

The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient capability check on the postdeactive function and postactivate function in all versions up to, and including, 4.8.4...

2.7CVSS5AI score0.00208EPSS
SaveExploits0References3
Cvelist
Cvelist•added 2025/10/25 5:31 a.m.•21 views

CVE-2025-11888 ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution <= 4.8.4 - Incorrect Authorization to Authenticated (Editor+) License Status Update

The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient capability check on the postdeactive function and postactivate function in all versions up to, and including, 4.8.4...

2.7CVSS0.00208EPSS
SaveExploits0References2
Rows per page
Query Builder