CVE-2026-93659

Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can store script payloads in billing name, email, or phone fields that execute in authenticated manager sessions to create rogue accounts o...

CVE-2026-93659 Concrete CMS Community Store before 2.7.8 Stored XSS

Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can store script payloads in billing name, email, or phone fields that execute in authenticated manager sessions to create rogue accounts o...

CVE-2026-93659

Concrete CMS Community Store before version 2.7.8 is vulnerable to Stored Cross-Site Scripting (XSS) because it fails to sanitize or HTML-escape customer-supplied fields, such as billing name, email, and phone numbers. These fields are stored as-is and rendered in four locations: the admin order ...

CVE-2026-93659 Concrete CMS Community Store before 2.7.8 Stored XSS

Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can store script payloads in billing name, email, or phone fields that execute in authenticated manager sessions to create rogue accounts o...

CVE-2026-93659 Concrete CMS Community Store before 2.7.8 Stored XSS

Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can store script payloads in billing name, email, or phone fields that execute in authenticated manager sessions to create rogue accounts o...

EUVD-2026-82941

Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can store script payloads in billing name, email, or phone fields that execute in authenticated manager sessions to create rogue accounts o...

WordPress Ultimate Store Kit plugin <= 3.0.7 - Cross-Site Scripting vulnerability

Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Ultimate Store Kit Elementor Addons versions = 3.0.7...

WordPress WP Multi Store Locator Pro plugin <= 4.5.1 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Rafie Muhammad in WordPress Plugin WP Multi Store Locator Pro versions = 4.5.1...

CVE-2026-16777

The Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.8.0 via the 'filename' parameter parameter. This makes it possible for authenticated attackers, with shop...

CVE-2026-15275

The WP Multi Store Locator Pro plugin for WordPress is vulnerable to generic SQL Injection via the 'storelocatoresearchradius' parameter in all versions up to, and including, 4.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

EUVD-2026-82761

The WP Multi Store Locator Pro plugin for WordPress is vulnerable to generic SQL Injection via the 'storelocatoresearchradius' parameter in all versions up to, and including, 4.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-15275

The WP Multi Store Locator Pro WordPress plugin is vulnerable to unauthenticated SQL injection in all versions up to and including 4.5.1 . The root cause is insufficient escaping and unprepared SQL in the store_locator_search_radius parameter, which sits in a numeric, unquoted context that bypass...

CVE-2026-15275 WP Multi Store Locator Pro <= 4.5.1 - Unauthenticated SQL Injection via 'store_locator_search_radius' Parameter

The WP Multi Store Locator Pro plugin for WordPress is vulnerable to generic SQL Injection via the 'storelocatoresearchradius' parameter in all versions up to, and including, 4.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-15275 WP Multi Store Locator Pro <= 4.5.1 - Unauthenticated SQL Injection via 'store_locator_search_radius' Parameter

The WP Multi Store Locator Pro plugin for WordPress is vulnerable to generic SQL Injection via the 'storelocatoresearchradius' parameter in all versions up to, and including, 4.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-16777

The Store Exporter WordPress plugin (for WooCommerce) is affected by a directory traversal vulnerability in all versions up to and including 2.8.0 . The flaw resides in the filename parameter , which is insufficiently validated, allowing authenticated attackers with Shop Manager privileges or hig...

CVE-2026-16777 Store Exporter <= 2.8.0 - Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read and Arbitrary File Deletion via 'filename' Parameter

The Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.8.0 via the 'filename' parameter parameter. This makes it possible for authenticated attackers, with shop...

EUVD-2026-82758

The Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.8.0 via the 'filename' parameter parameter. This makes it possible for authenticated attackers, with shop...

CVE-2026-16777 Store Exporter <= 2.8.0 - Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read and Arbitrary File Deletion via 'filename' Parameter

The Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.8.0 via the 'filename' parameter parameter. This makes it possible for authenticated attackers, with shop...

CVE-2026-84738

The AF Companion WordPress plugin before 2.2.0 does not validate the type of files uploaded through one of its import features, allowing users with a low-privileged store-management role to upload arbitrary files, including PHP ones, leading to Remote Code Execution...

CVE-2026-84738 AF Companion < 2.2.0 - Shop Manager+ Arbitrary File Upload to RCE

The AF Companion WordPress plugin before 2.2.0 does not validate the type of files uploaded through one of its import features, allowing users with a low-privileged store-management role to upload arbitrary files, including PHP ones, leading to Remote Code Execution...