CVE-2026-17581

The WCPOS – Point of Sale POS plugin for WooCommerce plugin for WordPress is vulnerable to Code Injection via the 'thermal' Template Engine in all versions up to, and including, 1.9.14 due to the ReceiptRendererFactory dispatching templates with the 'thermal' engine to the LegacyPhpRenderer inste...

PT-2026-73111

Name of the Vulnerable Software and Affected Versions WCPOS – Point of Sale POS plugin for WooCommerce versions prior to 1.9.15 Description Authenticated attackers with Shop Manager-level access or higher can perform code injection through the 'thermal' Template Engine. The issue occurs because t...