WordPress Product Variations Swatches for WooCommerce plugin <= 1.1.18 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Roll in WordPress Plugin Product Variations Swatches for WooCommerce versions = 1.1.18...

WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ivaylo Atanassov in WordPress Plugin Upsell Order Bump Offer for WooCommerce versions = 3.1.5...

CVE-2026-81280

Subscriber Sensitive Data Exposure in Print Barcode Labels for your WooCommerce products/orders = 4.0.0 versions...

CVE-2026-16947

CVE-2026-16947 affects the Total processing card payments for WooCommerce WordPress plugin (through version 7.3 ). The plugin fails to validate a user-supplied path before using it to build a server-side verification request, and does not verify the authenticity of the response. This allows unaut...

WordPress Return Refund and Exchange For WooCommerce plugin < 4.6.4 - Unauthenticated Guest Order Message Disclosure and Manipulation vulnerability

Unauthenticated Guest Order Message Disclosure and Manipulation vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Return Refund and Exchange For WooCommerce versions 4.6.4...

CVE-2026-16569 ShopApper <= 0.4.62 - Subscriber+ Arbitrary Product Stock Update

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not check the user's capabilities before allowing a stock-update operation through one of its REST endpoints, allowing any authenticated user, such as a customer or subscriber...

CVE-2026-16569

ShopApper (The Mobile App for WooCommerce) WordPress plugin versions through 0.4.62 (Patchstack reports affected up to 0.4.66) lack a capability check on a REST endpoint that handles stock-update operations. This allows any authenticated user with Subscriber role or higher to modify the stock qua...

EUVD-2026-66871

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not verify that the requesting user owns the customer profile being queried through one of its REST endpoints, allowing any authenticated user e.g. a customer/subscriber to...

PT-2026-82388

Name of the Vulnerable Software and Affected Versions ShopApper Mobile App Builder Service for WooCommerce WordPress plugin versions prior to 0.4.63 Description The plugin fails to verify user permissions before performing stock-update operations via a REST endpoint. This allows any authenticated...

CVE-2026-77695

The Return Refund and Exchange For WooCommerce WordPress plugin before 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX actions it exposes to unauthenticated users, allowing them to read private order messages, post messages and attachments in the customer's name,...

EUVD-2026-66283

The Order Tip for WooCommerce WordPress plugin before 1.6.0 does not check the capability of the user requesting a file deletion, nor does it restrict which path may be deleted, allowing users with the Shop Manager role and above to delete arbitrary files on the server, which could lead to the si...

EUVD-2026-64797

Unauthenticated Arbitrary File Deletion in WooCommerce File Approval = 10.7 versions...

CVE-2026-18027

The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 4.9.8 . The flaw resides in the get_image_src_in_base64 function, which processes the customer_note parameter witho...

CVE-2026-18027 WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 4.9.8 - Authenticated (Subscriber+) Arbitrary File Read via 'customer_note' Parameter

The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.9.8 via the getimagesrcinbase64 function. This makes it possible for authenticated attackers, with...

CVE-2026-77264 Automation Web Platform <= 4.8.6 - Unauthenticated Authentication Bypass via 'otp_transient' Token Disclosure

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 4.8.6. This is due to the handleemailotpreturn function returning the secret magic login token in the response t...

WordPress Cancel Order & Request Woocommerce plugin < 1.3.4.34 - Unauthenticated Order Content Disclosure via Reorder AJAX Actions vulnerability

Unauthenticated Order Content Disclosure via Reorder AJAX Actions vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Cancel order request WooCommerce versions 1.3.4.34...

CVE-2026-74009

Unauthenticated Insecure Direct Object References IDOR in Razorpay for WooCommerce = 4.8.7 versions...

CVE-2026-73181

Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce 7.6 versions...

EUVD-2026-60805

Unauthenticated Broken Authentication in Flutterwave WooCommerce = 3.3.0 versions...

CVE-2026-73398 WordPress Piraeus Bank WooCommerce Payment Gateway plugin 3.2.0 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 versions...