CVE-2026-104926

The WooCommerce Extra Product Options Pro plugin for WordPress (versions up to and including 3.3.2 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping associated with the _start and _end parameters. Unauthenticated attack...

EUVD-2026-114697

The WooCommerce Extra Product Options Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'start / end' parameter in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...

CVE-2026-109231

The Germanized for WooCommerce plugin for WordPress (versions

EUVD-2026-114696

The Germanized for WooCommerce plugin for WordPress is vulnerable to Unauthorized Access of Private Data via Activation Token Reuse in versions up to, and including, 4.1.4. This is due to the onuseremailchanged hook — which is responsible for rotating the activation token and recording a...

EUVD-2026-114695

The FlexStock – Product Stock Sync with Google Sheets for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'products.postcontent' parameter in all versions up to, and including, 3.17.2 due to insufficient input sanitization and output escaping. This makes it...

WordPress WooCommerce Extra Product Options Pro plugin <= 3.3.2 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by theviper17y in WordPress Plugin WooCommerce Extra Product Options Pro versions = 3.3.2...

CVE-2026-11396

The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Missing Authorization / Information Disclosure in all versions up to, and including, 3.4.6 via the 'filterSettingsdefaultquery' parameter of the 'filtersFrontend' AJAX action. The handler is registered as...

CVE-2026-88942

The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'wpffid' JSON Parameter in all versions up to, and including, 3.4.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers t...

CVE-2026-119065

The Shipping Zones by Drawing for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'szbd-picked' checkout parameter in versions up to, and including, 3.3.0 The szbdcheckoutfieldupdateordermeta handler stores stripslashessanitizetextfield$POST'szbd-picked' in...

CVE-2026-109217

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.16.5 via the 'invoicenumber via document filename' parameter. This makes it possible for unauthenticated attackers to extract another...

CVE-2026-109220

The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.1.1 via the 'customernote' parameter parameter. This is due to insufficient sanitization of the customernote checkout field, which is...

CVE-2026-110251

The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized Media Library File Deletion in all versions up to, and including, 1.2.31. This is due to the deletereviewsimage function's deletecomment hook trusting attachment IDs supplied via the wcprimageuploadid POST...

CVE-2026-107750

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'billingaddress.firstname / lastname / company, customernote' parameter in all versions up to, and including, 5.16.4 due to insufficient input sanitization and output escapin...

CVE-2026-11396

The Product Filter for WooCommerce by WBW plugin for WordPress (versions up to and including 3.4.6 ) is vulnerable to Missing Authorization leading to Information Disclosure . The issue exists in the filtersFrontend AJAX action (registered as wp_ajax_nopriv_filtersFrontend), which fails to perfor...

CVE-2026-11396 Product Filter for WooCommerce by WBW <= 3.4.6 - Missing Authorization to Unauthenticated Information Disclosure via filterSettings[default_query] Parameter

The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Missing Authorization / Information Disclosure in all versions up to, and including, 3.4.6 via the 'filterSettingsdefaultquery' parameter of the 'filtersFrontend' AJAX action. The handler is registered as...

EUVD-2026-114617

The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Missing Authorization / Information Disclosure in all versions up to, and including, 3.4.6 via the 'filterSettingsdefaultquery' parameter of the 'filtersFrontend' AJAX action. The handler is registered as...

CVE-2026-119065

The Shipping Zones by Drawing for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 3.3.0 . The root cause lies in the szbd_checkout_field_update_order_meta() handler, which stores the szbd-picked checkout parameter in order meta w...

CVE-2026-119065 Shipping Zones by Drawing for WooCommerce <= 3.3.0 - Unauthenticated Stored Cross-Site Scripting via 'szbd-picked' Checkout Parameter

The Shipping Zones by Drawing for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'szbd-picked' checkout parameter in versions up to, and including, 3.3.0 The szbdcheckoutfieldupdateordermeta handler stores stripslashessanitizetextfield$POST'szbd-picked' in...

EUVD-2026-114614

The Shipping Zones by Drawing for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'szbd-picked' checkout parameter in versions up to, and including, 3.3.0 The szbdcheckoutfieldupdateordermeta handler stores stripslashessanitizetextfield$POST'szbd-picked' in...

CVE-2026-110251

The Photo Reviews for WooCommerce plugin for WordPress (versions up to and including 1.2.31 ) is vulnerable to unauthorized Media Library File Deletion . The root cause lies in the delete_reviews_image() function's delete_comment hook, which trusts attachment IDs from the wcpr_image_upload_id POS...