CVE-2026-62928

XING CPTrans-ME-X , a rack accessory product, contains an OS Command Injection vulnerability (CWE-78) that allows unauthenticated attackers to inject arbitrary OS commands. The flaw carries a CVSS 9.8 CRITICAL score (v3.0) with high impact on confidentiality, integrity, and availability, indicati...

CVE-2026-62928

XING CPTrans-ME-X contains an OS Command Injection CWE-78. Unauthenticated OS command may be injected...

CVE-2026-84146 Xpro Elementor Addons < 1.7.8 - Unauthenticated Draft/Private Product Disclosure via Quick View

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does not perform any capability or post-status check before rendering a WooCommerce product summary from a supplied product identifier, allowing unauthenticated visitors to retrieve the title, price, SKU, description and...

CVE-2026-84146

CVE-2026-84146 affects the Xpro Addons — 140+ Widgets for Elementor WordPress plugin in versions prior to 1.7.8 . The plugin fails to perform a capability or post-status check before rendering a WooCommerce product summary from a supplied product identifier. This allows unauthenticated visitors t...

WordPress Xpro Addons — 140+ Widgets for Elementor plugin < 1.7.8 - Unauthenticated Draft/Private Product Disclosure vulnerability

Unauthenticated Draft/Private Product Disclosure vulnerability discovered by Moshe in WordPress Plugin Xpro Elementor Addons versions 1.7.8...

EUVD-2026-70913

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does not perform any capability or post-status check before rendering a WooCommerce product summary from a supplied product identifier, allowing unauthenticated visitors to retrieve the title, price, SKU, description and...

CVE-2026-81347 Frontend Admin by DynamiApps < 3.29.13 - Unauthenticated .htaccess and index.php Deletion via Custom Directory Path Traversal

The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 does not properly validate a user-controllable directory path before deleting files within it, allowing unauthenticated attackers to delete index.php and .htaccess files outside the intended directory, including the WordPress root,...

CVE-2026-81347

The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 fails to properly validate a user-controllable directory path before deleting files within it. This allows unauthenticated attackers to delete index.php and .htaccess files outside the intended directory, including the WordPress roo...

EUVD-2026-70908

The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 does not properly validate a user-controllable directory path before deleting files within it, allowing unauthenticated attackers to delete index.php and .htaccess files outside the intended directory, including the WordPress root,...

CVE-2026-79631 WPFunnels < 3.13.0 - Unauthenticated Order and Opt-In PII Disclosure via Web-Accessible Log Files

The WPFunnels WordPress plugin before 3.13.0 does not restrict access to the log files it writes to a predictable location under the public uploads directory, allowing unauthenticated users to download customer order details and opt-in form submissions when logging is enabled...

EUVD-2026-70904

The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a checkout order bump is the product that bump's discount was configured for, allowing unauthenticated users to obtain any purchasable product at a discount intended for a different one, with the reduc...

WordPress WPFunnels plugin < 3.13.0 - Unauthenticated Price Manipulation vulnerability

Unauthenticated Price Manipulation vulnerability discovered by Aditya Gurav in WordPress Plugin WPFunnels versions 3.13.0...

WordPress WPFunnels plugin < 3.13.0 - Unauthenticated Order and Opt-In PII Disclosure vulnerability

Unauthenticated Order and Opt-In PII Disclosure vulnerability discovered by Abdullah Kareem in WordPress Plugin WPFunnels versions 3.13.0...

CVE-2026-79631

The WPFunnels WordPress plugin (versions before 3.13.0 ) fails to restrict access to log files it writes to a predictable path under the public uploads directory. When logging is enabled, unauthenticated users can download these files, exposing customer order details and opt-in form submissions (...

EUVD-2026-70906

The WPFunnels WordPress plugin before 3.13.0 does not perform any authorisation or nonce check in one of its opt-in submission handlers, and takes the notification recipients and subject from the request, allowing unauthenticated users to make the site send emails to arbitrary recipients with an...

WordPress WPFunnels plugin < 3.13.0 - Unauthenticated Arbitrary Recipient Email Sending vulnerability

Unauthenticated Arbitrary Recipient Email Sending vulnerability discovered by Sai Praneeth Koti in WordPress Plugin WPFunnels versions 3.13.0...

CVE-2026-79632

The WPFunnels WordPress plugin before 3.13.0 lacks an authorisation or nonce check in its wpfnl_shortcode_optin_submission handler. Because the notification recipients and subject are taken directly from the request, unauthenticated users can cause the site to send emails to arbitrary recipients ...

CVE-2026-79630

The WPFunnels WordPress plugin prior to 3.13.0 contains an unauthenticated price manipulation vulnerability in its checkout order-bump feature. The plugin fails to verify that the product ID submitted via an order bump matches the product for which the bump's discount was configured. An unauthent...

EUVD-2026-70905

The WPFunnels WordPress plugin before 3.13.0 does not restrict access to the log files it writes to a predictable location under the public uploads directory, allowing unauthenticated users to download customer order details and opt-in form submissions when logging is enabled...

CVE-2026-79630 WPFunnels < 3.13.0 - Unauthenticated Price Manipulation via Order Bump Product ID Substitution

The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a checkout order bump is the product that bump's discount was configured for, allowing unauthenticated users to obtain any purchasable product at a discount intended for a different one, with the reduc...