109 matches found
CVE-2026-7655: Weak Password Recovery Mechanism for Forgotten Password
The SureCart plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 4.2.3. This is due to the plugin not properly validating a user's identity prior to updating their details like email during customer profile synchronization from webhook...
CVE-2026-13039
The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to authorization bypass due to a regression in versions from 4.0.26 up to and including 4.1.15. This is due to the plugin not properly verifying that a user is authorized to perform a...
CVE-2026-13039 Eventin 4.0.26 - 4.1.15 - Missing Authorization to Unauthenticated Payment Bypass via REST API
The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to authorization bypass due to a regression in versions from 4.0.26 up to and including 4.1.15. This is due to the plugin not properly verifying that a user is authorized to perform a...
EUVD-2026-43025
The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to authorization bypass due to a regression in versions from 4.0.26 up to and including 4.1.15. This is due to the plugin not properly verifying that a user is authorized to perform a...
CVE-2026-13039: Missing Authorization
The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to authorization bypass due to a regression in versions from 4.0.26 up to and including 4.1.15. This is due to the plugin not properly verifying that a user is authorized to perform a...
CVE-2026-57314
Unauthenticated Cross Site Scripting XSS in SureCart = 4.3.2 versions...
CVE-2026-57313
Subscriber Cross Site Scripting XSS in SureCart = 4.2.2 versions...
CVE-2026-57313 WordPress SureCart plugin <= 4.2.2 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting XSS in SureCart = 4.2.2 versions...
CVE-2026-57313 WordPress SureCart plugin <= 4.2.2 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting XSS in SureCart = 4.2.2 versions...
CVE-2026-57314 WordPress SureCart plugin <= 4.3.2 - Reflected Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in SureCart = 4.3.2 versions...
EUVD-2026-39727
Unauthenticated Cross Site Scripting XSS in SureCart = 4.3.2 versions...
EUVD-2026-39726
Subscriber Cross Site Scripting XSS in SureCart = 4.2.2 versions...
CVE-2026-57314
Unauthenticated Cross Site Scripting XSS in SureCart = 4.3.2 versions...
CVE-2026-57314 WordPress SureCart plugin <= 4.3.2 - Reflected Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in SureCart = 4.3.2 versions...
CVE-2026-57313
Subscriber Cross Site Scripting XSS in SureCart = 4.2.2 versions...
CVE-2026-57313
CVE-2026-57313 concerns a Subscriber XSS vulnerability in the WordPress plugin SureCart up to version 4.2.2 . The public records describe an XSS issue affecting subscribers, but do not provide concrete exploit scenarios, affected subcomponents, or a detailed root cause beyond the general class of...
CVE-2026-57314
CVE-2026-57314 affects the WordPress SureCart plugin ≤ 4.3.2 with an unauthenticated reflected XSS vulnerability. The impact per the records is LOW confidentiality/integrity/availability, high overall severity (CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The root cause involves improper handl...
WordPress SureCart plugin <= 4.3.2 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by Bonds in WordPress Plugin SureCart versions = 4.3.2...
