CVE-2026-122673

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Wpmet ShopEngine shopengine allows Stored XSS.This issue affects ShopEngine: from n/a through 4.9.8...

EUVD-2026-120048

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Wpmet ShopEngine shopengine allows Stored XSS.This issue affects ShopEngine: from n/a through 4.9.8...

CVE-2026-122673

The Wpmet ShopEngine WordPress plugin (versions

CVE-2026-122673 WordPress ShopEngine plugin <= 4.9.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Wpmet ShopEngine shopengine allows Stored XSS.This issue affects ShopEngine: from n/a through 4.9.8...

PT-2026-140404

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Wpmet ShopEngine shopengine allows Stored XSS.This issue affects ShopEngine: from n/a through 4.9.8...

CVE-2026-122673: Wpmet ShopEngine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet ShopEngine…

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Wpmet ShopEngine shopengine allows Stored XSS.This issue affects ShopEngine: from n/a through 4.9.8...

WordPress ShopEngine plugin <= 4.9.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by iblitzc0de in WordPress Plugin ShopEngine versions = 4.9.8...

CVE-2026-92396

The ShopEngine Gutenberg WooCommerce Builder Blocks Addon WordPress plugin before 2.4.4 does not validate the user's capabilities or the ownership of the targeted post in one of its AJAX actions, and does not escape the stored value before outputting it in a JavaScript context, allowing users wit...

CVE-2026-92396

The ShopEngine Gutenberg WooCommerce Builder Blocks Addon WordPress plugin (versions before 2.4.4 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is a failure to validate user capabilities or post ownership within an AJAX action , combined with insufficient escaping of...

EUVD-2026-117908

The ShopEngine Gutenberg WooCommerce Builder Blocks Addon WordPress plugin before 2.4.4 does not validate the user's capabilities or the ownership of the targeted post in one of its AJAX actions, and does not escape the stored value before outputting it in a JavaScript context, allowing users wit...

WordPress ShopEngine Gutenberg WooCommerce Builder Blocks Addon plugin < 2.4.4 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by JunHee CHO in WordPress Plugin ShopEngine Gutenberg WooCommerce Builder Blocks Addon versions 2.4.4...

CVE-2026-92396 Blocks for ShopEngine < 2.4.4 - Contributor+ Stored XSS via gutenova_store_css

The ShopEngine Gutenberg WooCommerce Builder Blocks Addon WordPress plugin before 2.4.4 does not validate the user's capabilities or the ownership of the targeted post in one of its AJAX actions, and does not escape the stored value before outputting it in a JavaScript context, allowing users wit...

CVE-2026-85575

The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘shopengineproducttitleheadersize’ parameter in all versions up to, and including, 4.9.5 due to...

CVE-2026-85575 The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets <= 4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shopengine_product_title_header_size' Parameter

The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘shopengineproducttitleheadersize’ parameter in all versions up to, and including, 4.9.5 due to...

CVE-2026-85575

The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin (versions up to and including 4.9.5 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the shopengine_product_title_header_size parameter, caused by insufficient input sanitization and output escaping . Authenticated attack...

CVE-2026-85575 The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets <= 4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shopengine_product_title_header_size' Parameter

The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘shopengineproducttitleheadersize’ parameter in all versions up to, and including, 4.9.5 due to...

EUVD-2026-78243

The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘shopengineproducttitleheadersize’ parameter in all versions up to, and including, 4.9.5 due to...

PT-2026-91774

The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘shopengine product title header size’ parameter in all versions up to, and including, 4.9.5 due to...

CVE-2026-85575: Improper Neutralization of Input During Web Page Generation

The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘shopengineproducttitleheadersize’ parameter in all versions up to, and including, 4.9.5 due to...

WordPress ShopEngine Elementor WooCommerce Builder Addon plugin <= 4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Romain Deperne ang3L in WordPress Plugin ShopEngine versions = 4.9.5...