267 matches found
CVE-2024-50482
CVE-2024-50482 Woocommerce Product Design = 1.0.0 - 인증되지 않은 임의 파일 업로드 설명: Woocommerce Product Design 플러그인은 WordPress에서 사용되며, 1.0.0까지의 모든 버전에서 파일 유형 검증이 누락되어 임의 파일 업로드에 취약합니다. 이로 인해 인증되지 않은 공격자가 영향받은 사이트 서버에 임의 파일을 업로드할 수 있으며, 이는 원격 코드 실행으로 이어질 수 있습니다. root@kitploit: Published: 2024-10-25 00:00:00...
CVE-2026-84146
The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does not perform any capability or post-status check before rendering a WooCommerce product summary from a supplied product identifier, allowing unauthenticated visitors to retrieve the title, price, SKU, description and...
WordPress Product Addons & Fields for WooCommerce < 32.0.7 - Cross-Site Scripting
The Product Addons & Fields for WooCommerce WordPress plugin before version 32.0.7 contains a reflected cross-site scripting vulnerability. The plugin does not properly sanitize and escape some URL parameters in the admin panel, which could allow attackers to execute arbitrary JavaScript code in ...
CVE-2024-50508
CVE-2024-50508 Woocommerce Product Design = 1.0.0 - 인증되지 않은 임의 파일 다운로드 설명 WordPress용 Woocommerce Product Design 플러그인은 1.0.0 버전까지포함의 모든 버전에서 디렉터리 트래버설에 취약합니다. 이로 인해 인증되지 않은 공격자가 서버에 있는 임의 파일의 내용을 읽을 수 있으며, 여기에는 민감한 정보가 포함될 수 있습니다. 세부 정보 유형 : 플러그인 슬러그 : woo-product-design 영향을 받는 버전 : 1.0.0 CVSS 점수 ...
EUVD-2026-69931
Unauthenticated Sensitive Data Exposure in WooCommerce Product Attachment = 2.3.3 versions...
CVE-2026-81774 WordPress WooCommerce Product Attachment plugin <= 2.3.3 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in WooCommerce Product Attachment = 2.3.3 versions...
CVE-2026-81774
CVE-2026-81774 affects the WooCommerce Product Attachment WordPress plugin in versions 2.3.3 and below , introducing an unauthenticated Sensitive Data Exposure vulnerability. The flaw allows a remote, unauthenticated attacker over the network to access confidential data, with a CVSS 3.1 base scor...
WordPress WooCommerce Product Attachment plugin <= 2.3.3 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by Jakub Herman in WordPress Plugin WooCommerce Product Attachment versions = 2.3.3...
WordPress Product Table & List Builder For WooCommerce plugin <= 5.6.0 - Unauthenticated CSS Injection via 'laptop_scroll_offset' Parameter vulnerability
Unauthenticated CSS Injection via 'laptopscrolloffset' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin WooCommerce Product Table Lite versions = 5.6.0...
CVE-2026-19089 Product Input Fields for WooCommerce < 2.0.2 - Unauthenticated Arbitrary File Upload
The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded file types when its accepted-types setting is left empty, which its own documentation advertises as accepting all files, allowing unauthenticated attackers to upload arbitrary files and achieve remot...
CVE-2026-16285
The CVE-2026-16285 affects the WooCommerce Product Attachment WordPress plugin (prior to version 2.3.3). The root cause is a missing authorization check when streaming media library files, enabling unauthenticated users to download any attachment by enumerating its numeric ID. Impact is stated as...
CVE-2026-13345 Essential Addons for Elementor - Lite < 6.6.10 - Unauthenticated Draft/Private WooCommerce Product Disclosure via Compare Table
The Essential Addons for Elementor WordPress plugin before 6.6.10 does not perform authorization, status, or visibility checks when resolving WooCommerce products in its product-comparison feature, allowing unauthenticated users to disclose the title, price, and SKU of draft, pending, and private...
Exploit for CVE-2026-49777
!AMN SECURITYhttps://img.shields.io/badge/AMN-SECURITY-000000...
CVE-2026-11568 Product Configurator for WooCommerce < 1.7.3 - Unauthenticated Private/Draft Product Data Disclosure via pc_get_data
The Product Configurator for WooCommerce WordPress plugin before 1.7.3 does not perform any authorisation or post-status check before returning WooCommerce product data through a public AJAX action, allowing unauthenticated users to retrieve the data title, price, weight, stock status, and...
CVE-2026-40725 WordPress WooCommerce Product Filters plugin < 2.0.6 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in WooCommerce Product Filters 2.0.6 versions...
CVE-2026-40725
CVE-2026-40725 affects the WordPress WooCommerce Product Filters plugin (versions
CVE-2026-49061
Unauthenticated Arbitrary File Download in WPC Product Options for WooCommerce = 3.2.1 versions...
CVE-2026-48883
Unauthenticated Broken Access Control in WPC Product Bundles for WooCommerce = 8.5.3 versions...