CVE-2023-0214

SWG Exploit Generator ██████╗ ██████╗ ████████╗███████╗ ██╔═████╗██╔══██╗╚══██╔══╝██╔════╝ ██║██╔██║██████╔╝ ██║ ███████╗ ████╔╝██║██╔═══╝ ██║ ╚════██║ ╚██████╔╝██║ ██║ ███████║ ╚═════╝ ╚═╝ ╚═╝ ╚══════╝ by 0PTS Proof of Concept for the HTTP Response Splitting vulnerability in Skyhigh Secure Web...

CVE-2026-92999 Click n Chat 1.0.4 - 1.1.2 - Unauthenticated Lead Data Disclosure via click_n_chat_update_lead_list_export_action

The Click n Chat Chat Widget Integration WordPress plugin before 1.1.3 does not perform any authorization check on a lead-export handler, allowing unauthenticated users to download every captured contact record names, email addresses and phone numbers...

CVE-2026-92999

The Click n Chat (Chat Widget Integration) WordPress plugin, in versions 1.0.4 through 1.1.2 , is vulnerable to an unauthenticated lead data disclosure vulnerability. The root cause is a lack of authorization checks on a lead-export handler, specifically via the click_n_chat_update_lead_list_expo...

CVE-2026-92999 Click n Chat 1.0.4 - 1.1.2 - Unauthenticated Lead Data Disclosure via click_n_chat_update_lead_list_export_action

The Click n Chat Chat Widget Integration WordPress plugin before 1.1.3 does not perform any authorization check on a lead-export handler, allowing unauthenticated users to download every captured contact record names, email addresses and phone numbers...

WordPress Click n Chat (Chat Widget Integration) plugin 1.0.4-1.1.2 - Unauthenticated Lead Data Disclosure vulnerability

Unauthenticated Lead Data Disclosure vulnerability discovered by Mokksh Parekh in WordPress Plugin Click n Chat Chat Widget Integration versions 1.0.4-1.1.2...

EUVD-2026-107045

The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.2.0 does not verify the integrity of its cart-recovery token before acting on it and still accepts an unsigned legacy token format, allowing unauthenticated attackers who know a victim's cart session identifier to modify that...

EUVD-2026-107044

The Click n Chat Chat Widget Integration WordPress plugin before 1.1.3 does not perform any authorization check on a lead-export handler, allowing unauthenticated users to download every captured contact record names, email addresses and phone numbers...

CVE-2026-88784 Weglot < 6.4.3 - Unauthenticated Stored XSS via Translated Page Link Rewriting

The Translate WordPress with Weglot 2.0 WordPress plugin before 6.4.3 does not escape the URLs it re-inserts into a page when rewriting links for a translated language, and reverses the encoding that was applied to them beforehand, allowing unauthenticated users to store a payload which executes ...

CVE-2026-88784

The Translate WordPress with Weglot 2.0 plugin (versions before 6.4.3 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to escape URLs during the link rewriting process for translated languages, coupled with a reversal of previous encoding. This allows unauthentic...

CVE-2026-87838 Wava Payment 0.3.1 - 0.3.9 - Unauthenticated Merchant Credential Overwrite via Install Webhook

The Wava Payment Plugin WordPress plugin before 0.3.10 does not perform any authorisation, nonce or origin verification on one of its public REST endpoints, allowing unauthenticated attackers to overwrite the stored credential that identifies the merchant account the store's payments are created...

CVE-2026-87838 Wava Payment 0.3.1 - 0.3.9 - Unauthenticated Merchant Credential Overwrite via Install Webhook

The Wava Payment Plugin WordPress plugin before 0.3.10 does not perform any authorisation, nonce or origin verification on one of its public REST endpoints, allowing unauthenticated attackers to overwrite the stored credential that identifies the merchant account the store's payments are created...

EUVD-2026-107089

The Click n Chat Chat Widget Integration WordPress plugin before 1.1.3 does not properly validate a parameter before using it as a column identifier in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks...

EUVD-2026-107088

The Translate WordPress with Weglot 2.0 WordPress plugin before 6.4.3 does not escape the URLs it re-inserts into a page when rewriting links for a translated language, and reverses the encoding that was applied to them beforehand, allowing unauthenticated users to store a payload which executes ...

EUVD-2026-107086

The Wava Payment Plugin WordPress plugin before 0.3.10 does not verify the authenticity of incoming payment-provider notifications, nor restrict who may send them, allowing unauthenticated attackers to change the status of any WooCommerce order in the store, including marking an unpaid order as...

EUVD-2026-107043

The Click n Chat Chat Widget Integration WordPress plugin before 1.1.3 does not sanitise sort parameters before using them in a SQL ORDER BY clause, allowing unauthenticated attackers to perform SQL injection attacks...

EUVD-2026-107087

The Wava Payment Plugin WordPress plugin before 0.3.10 does not perform any authorisation, nonce or origin verification on one of its public REST endpoints, allowing unauthenticated attackers to overwrite the stored credential that identifies the merchant account the store's payments are created...

CVE-2026-111956 WholesaleX < 3.0.9 - Unauthenticated Imported User CSV Disclosure

The WholesaleX WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly accessible location under a predictable name, allowing unauthenticated users to download the most recently imported user data, including any account passwords and customer contact a...

CVE-2026-111956 WholesaleX < 3.0.9 - Unauthenticated Imported User CSV Disclosure

The WholesaleX WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly accessible location under a predictable name, allowing unauthenticated users to download the most recently imported user data, including any account passwords and customer contact a...

WordPress TI WooCommerce Wishlist plugin < 2.13.0 - Unauthenticated Private Wishlist Disclosure vulnerability

Unauthenticated Private Wishlist Disclosure vulnerability discovered by Duy Tran in WordPress Plugin TI WooCommerce Wishlist versions 2.13.0...

CVE-2026-111956

The WholesaleX WordPress plugin versions prior to 3.0.9 contains a vulnerability where it fails to protect or remove the user-import file . This file is stored in a publicly accessible location using a predictable name, which allows unauthenticated users to download the most recently imported use...