CVE-2026-81534

The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to Remote Code Execution (RCE) in versions up to and including 3.9.5 . The root cause is insufficient authorization and input sanitization within the send_test_mail() function, which allows for the injection of user-con...

CVE-2026-81534 Email Customizer for WooCommerce (Pro) <= 3.9.5 - Authenticated (Subscriber+) Remote Code Execution via 'template' Parameter

The Email Customizer for WooCommerce Pro plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9.5. This is due to insufficient authorization and input sanitization in the sendtestmail function, which allows user-controlled PHP code to be written to...

WordPress Event Booking Manager for WooCommerce (Pro) plugin <= 5.0.2 - Unauthenticated Price Manipulation vulnerability

Unauthenticated Price Manipulation vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Event Booking Manager for WooCommerce Pro versions = 5.0.2...

WordPress Gift Cards For WooCommerce Pro plugin < 4.2.10 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Brandon Steed in WordPress Plugin Gift Cards For WooCommerce Pro versions 4.2.10...

CVE-2026-15039

The Gift Cards For WooCommerce Pro WordPress plugin (versions

CVE-2026-15039 Gift Cards For WooCommerce Pro < 4.2.10 - Unauthenticated Arbitrary File Upload

The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution...

CVE-2026-15039 Gift Cards For WooCommerce Pro < 4.2.10 - Unauthenticated Arbitrary File Upload

The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution...

EUVD-2026-54202

The Event Booking Manager for WooCommerce Pro WordPress plugin before 5.0.3 does not validate the ticket price on the server during its native non-WooCommerce checkout, trusting the per-ticket price supplied by the client instead of re-deriving the event's configured price. This allows...

CVE-2026-16067 Event Booking Manager for WooCommerce (Pro) < 5.0.3 - Unauthenticated Payment Bypass via Client-Controlled Ticket Price

The Event Booking Manager for WooCommerce Pro WordPress plugin before 5.0.3 does not validate the ticket price on the server during its native non-WooCommerce checkout, trusting the per-ticket price supplied by the client instead of re-deriving the event's configured price. This allows...

CVE-2026-16067

The CVE concerns the Event Booking Manager for WooCommerce (Pro) WordPress plugin, affected versions prior to 5.0.3. The vulnerability arises because the plugin does not validate the ticket price on the server during its native checkout, trusting the per-ticket price supplied by the client. As a ...

CVE-2026-16067: External Control of Assumed-Immutable Web Parameter

The Event Booking Manager for WooCommerce Pro WordPress plugin before 5.0.3 does not validate the ticket price on the server during its native non-WooCommerce checkout, trusting the per-ticket price supplied by the client instead of re-deriving the event's configured price. This allows...

PT-2026-68658

The Event Booking Manager for WooCommerce Pro WordPress plugin before 5.0.3 does not validate the ticket price on the server during its native non-WooCommerce checkout, trusting the per-ticket price supplied by the client instead of re-deriving the event's configured price. This allows...

WordPress Checkout Field Editor for WooCommerce (Pro) plugin <= 3.7.7 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read vulnerability

Authenticated Subscriber+ Path Traversal to Arbitrary File Read vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Checkout Field Editor for WooCommerce Pro versions = 3.7.7...

CVE-2026-15414: Improper Privilege Management

The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.0.0. This is due to the savemetaboxes function persisting the wpsplanuserrole membership plan meta from $POST without an allowlist that excludes privileged roles — the...

CVE-2026-14955

The Checkout Field Editor for WooCommerce Pro plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.7.7 via the 'thwcfelegacyfile' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the content...

CVE-2026-14955 Checkout Field Editor for WooCommerce (Pro) <= 3.7.7 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'thwcfe_legacy_file' Parameter

The Checkout Field Editor for WooCommerce Pro plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.7.7 via the 'thwcfelegacyfile' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the content...

CVE-2026-14955: Improper Limitation of a Pathname to a Restricted Directory

The Checkout Field Editor for WooCommerce Pro plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.7.7 via the 'thwcfelegacyfile' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the content...

CVE-2026-10735 ShapedPlugin Multiple Pro Plugins - Backdoor via Compromised Vendor Update Server

Multiple Shapedsmart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Product Slider for WooCommerce Pro WordPress plugin before 3.5.3 Pro smart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Produ...

CVE-2026-10735: Undefined Security Weakness

Multiple Shapedsmart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Product Slider for WooCommerce Pro WordPress plugin before 3.5.3 Pro smart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Produ...

CVE-2026-45444

Unrestricted Upload of File with Dangerous Type vulnerability in WP Swings Gift Cards For WooCommerce Pro allows Using Malicious Files. This issue affects Gift Cards For WooCommerce Pro: from n/a through 4.2.6...