156 matches found
CVE-2026-32575
Unauthenticated Cross Site Scripting XSS in SUMO Affiliates Pro = 11.7.0 versions...
CVE-2026-32575 WordPress SUMO Affiliates Pro plugin <= 11.7.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in SUMO Affiliates Pro = 11.7.0 versions...
EUVD-2026-93237
Unauthenticated Cross Site Scripting XSS in SUMO Affiliates Pro = 11.7.0 versions...
CVE-2026-32575
The SUMO Affiliates Pro plugin for WordPress, version
CVE-2026-32575 WordPress SUMO Affiliates Pro plugin <= 11.7.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in SUMO Affiliates Pro = 11.7.0 versions...
PT-2026-106402
Name of the Vulnerable Software and Affected Versions SUMO Affiliates Pro versions prior to 11.7.1 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication...
WordPress SUMO Affiliates Pro plugin <= 11.7.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin SUMO Affiliates Pro versions = 11.7.0...
Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1
In the Linux kernel, the following vulnerabilities have been resolved: drm/radeon: fixed the UBSAN warning in kvdpm.c Added a bounds check for sumovidmappingentry...
Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1
In the Linux kernel, the following vulnerabilities have been resolved: drm/amdgpu: fixed the UBSAN warning in kvdpm.c Added a bounds check for sumovidmappingentry...
WordPress SUMO Reward Points for WooCommerce plugin <= 32.7.0 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Nguyen Cong Quang in WordPress Plugin SUMO Reward Points versions = 32.7.0...
CVE-2026-7534 SUMO Reward Points for WooCommerce <= 32.7.0 - Unauthenticated Stored Cross-Site Scripting via 'reason' Parameter
The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REST API endpoint /wp-json/wc-srp/v1/earning in versions up to, and including, 32.7.0. This is due to the userhascap filter in the SRPRESTEarningController class unconditionally granti...
CVE-2026-7534
The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REST API endpoint /wp-json/wc-srp/v1/earning in versions up to, and including, 32.7.0. This is due to the userhascap filter in the SRPRESTEarningController class unconditionally granti...
EUVD-2026-47877
The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REST API endpoint /wp-json/wc-srp/v1/earning in versions up to, and including, 32.7.0. This is due to the userhascap filter in the SRPRESTEarningController class unconditionally granti...
CVE-2026-7534
The CVE-2026-7534 entry details a vulnerability in the SUMO Reward Points for WooCommerce plugin (WordPress) up to version 32.7.0. Affected component: SRP_REST_Earning_Controller handling REST endpoint /wp-json/wc-srp/v1/earning. Root cause: the user_has_cap filter unconditionally grants the rs_e...
PT-2026-63572
The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REST API endpoint /wp-json/wc-srp/v1/earning in versions up to, and including, 32.7.0. This is due to the user has cap filter in the SRP REST Earning Controller class unconditionally...
CVE-2026-7534: Improper Neutralization of Input During Web Page Generation
The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REST API endpoint /wp-json/wc-srp/v1/earning in versions up to, and including, 32.7.0. This is due to the userhascap filter in the SRPRESTEarningController class unconditionally granti...
Malicious code in siempyl-sumo (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 493e667735febe5b3e4cd2cc47ae0b5a09ddacf051dc2804e5e742574ceb5ec4 Dependency confusion attempt. The user identifies themselves as a HackerOne user abusing the PyPI for the purpose of a bug bounty program. This package did not...
CVE-2026-24989
Deserialization of Untrusted Data vulnerability in FantasticPlugins SUMO Affiliates Pro affs allows Object Injection.This issue affects SUMO Affiliates Pro: from n/a through 11.4.0...