CVE-2026-17581

The CVE concerns the WCPOS – Point of Sale (POS) plugin for WooCommerce (WordPress). Affected versions: up to 1.9.14. Root cause: the Receipt_Renderer_Factory dispatches templates using the thermal engine to the Legacy_Php_Renderer instead of a safe thermal-specific renderer, enabling Code Inject...

CVE-2026-17581

The WCPOS – Point of Sale POS plugin for WooCommerce plugin for WordPress is vulnerable to Code Injection via the 'thermal' Template Engine in all versions up to, and including, 1.9.14 due to the ReceiptRendererFactory dispatching templates with the 'thermal' engine to the LegacyPhpRenderer inste...

EUVD-2026-59905

The WCPOS – Point of Sale POS plugin for WooCommerce plugin for WordPress is vulnerable to Code Injection via the 'thermal' Template Engine in all versions up to, and including, 1.9.14 due to the ReceiptRendererFactory dispatching templates with the 'thermal' engine to the LegacyPhpRenderer inste...

CVE-2026-16078

The WCPOS – Point of Sale POS plugin for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.9.8 via the 'type' parameter parameter. This makes it possible for authenticated attackers, with shop manager-level access and above, to read the...

@bildvitta/vuex-offline (>=3.0.0-beta.0 <=3.0.0-beta.3), @indexeddb-orm/idb-orm (>=0.0.1 <=0.0.3) +4 more potentially affected by CVE-2022-21189 via dexie (>=4.0.0-alpha.1 <=4.0.0-alpha.2)

dexie NPM version =4.0.0-alpha.1, =3.0.0-beta.0, =0.0.1, =1.0.0, =1.0.0, =11.5.0, =12.4.1 Source cves: CVE-2022-21189 Source advisory: SNYK:JS-DEXIE-2607042...