CVE-2026-14270

The Extra Checkout Options addon for Extra Product Options & Add-Ons for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.3.2. This is due to missing authorization and nonce validation in the ecosavesettings function, which allows...

CVE-2026-14270

The Extra Checkout Options addon for Extra Product Options & Add-Ons for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.3.2. This is due to missing authorization and nonce validation in the ecosavesettings function, which allows...

CVE-2026-50622

Description: Missing Authorization in Apache Atlas. A missing authorization vulnerability in Apache Atlas's admin endpoints allows any authenticated user, regardless of their assigned role, to perform administrative operations. Affect Version: This issue affects Apache Atlas: from 0.8 through...

CVE-2025-10656

The Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.37 vi the userfilter function. This makes it possible for unauthenticated attackers to create admin accounts...

EUVD-2026-50273

The Booking System Trafft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bookingWebsiteUrl setting in all versions up to, and including, 1.0.17 due to a missing capability check on the setoptions AJAX action when the plugin is operating in agency mode. The...

CVE-2026-8791

CVE-2026-8791 affects the Booking System Trafft WordPress plugin (versions up to 1.0.17). A missing capability check in the set_options AJAX handler (in agency mode) allows authenticated users with Subscriber+ to update the trafft_option with a bookingWebsiteUrl value, enabling the plugin to enqu...

CVE-2026-8791 Booking System Trafft <= 1.0.17 - Authenticated (Subscriber+) Stored Cross-Site Scripting

The Booking System Trafft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bookingWebsiteUrl setting in all versions up to, and including, 1.0.17 due to a missing capability check on the setoptions AJAX action when the plugin is operating in agency mode. The...

Privilege Escalation

FileGator is vulnerable to Privilege Escalation. The vulnerability is due to insufficient validation of user-supplied file permission values, where arbitrary Unix permission modes are passed directly to chmod, allowing authenticated users with chmod permission to escalate privileges to root...

EUVD-2026-50237

Description: Missing Authorization in Apache Atlas. A missing authorization vulnerability in Apache Atlas's admin endpoints allows any authenticated user, regardless of their assigned role, to perform administrative operations. Affect Version: This issue affects Apache Atlas: from 0.8 through...

CVE-2026-50622 Apache Atlas: Missing Authorization on Admin Endpoints

Description: Missing Authorization in Apache Atlas. A missing authorization vulnerability in Apache Atlas's admin endpoints allows any authenticated user, regardless of their assigned role, to perform administrative operations. Affect Version: This issue affects Apache Atlas: from 0.8 through...

EUVD-2025-210524

The Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.37 vi the userfilter function. This makes it possible for unauthenticated attackers to create admin accounts...

EUVD-2026-50136

An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of any other user without authorisation, disclosing private learning progress information...

CVE-2026-63241 Insecure direct object reference vulnerability

An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of any other user without authorisation, disclosing private learning progress information...

CVE-2026-63241

Koollab LMS is affected by an insecure direct object reference vulnerability that allows an authenticated user to query the course completion progress of other users without proper authorization, leading to disclosure of private learning progress information. The root cause is an insecure direct ...

CVE-2026-17161

The CVE-2026-17161 entry documents a Stored Cross-Site Scripting vulnerability in the WowStore – Store Builder & Product Blocks for WordPress plugin. Affected: WordPress plugin WowStore (Product Blocks) up to version 4.4.24. Vulnerable component: the filterMobileText Block Attribute; root cause i...

CVE-2026-17162 WowStore <= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'currentPostId' Block Attribute

The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'currentPostId' Block Attribute in all versions up to, and including, 4.4.24 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-17162

The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'currentPostId' Block Attribute in all versions up to, and including, 4.4.24 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-12144 Wholesale for WooCommerce <= 2.0.5 - Authenticated (Author+) Privilege Escalation via 'user_role_set' Parameter

The Wholesale for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.5. This is due to the saverequestsmeta function applying only sanitizetextfield to the userroleset POST parameter before passing it directly to WPUser::addrole, with ...

CVE-2026-12938 Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute

The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' attribute of the newsletterspost shortcode in versions up to and including 4.15. This is due to insufficient input sanitization and output escaping in the postssingle function which propagates...

PT-2026-65784

The Extra Checkout Options addon for Extra Product Options & Add-Ons for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.3.2. This is due to missing authorization and nonce validation in the eco save settings function, which allows...