24443 matches found
CVE-2026-93624 WordPress Music Player for WooCommerce plugin <= 1.9.1 - PHP Object Injection vulnerability
Shop manager PHP Object Injection in Music Player for WooCommerce = 1.9.1 versions...
EUVD-2026-89826
Shop manager PHP Object Injection in Music Player for WooCommerce = 1.9.1 versions...
CVE-2026-93624
The Music Player for WooCommerce plugin for WordPress (versions
WordPress Pay with Vipps for WooCommerce plugin <= 6.2.4 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Pay with Vipps for WooCommerce versions = 6.2.4...
WordPress Razorpay Payment Links for WooCommerce plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Oly Hossen in WordPress Plugin Razorpay Payment Links for WooCommerce versions = 2.1.5...
WordPress Premmerce Permalink Manager for WooCommerce plugin <= 2.3.13 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin Premmerce Permalink Manager for WooCommerce versions = 2.3.13...
CVE-2026-93580 InPost for WooCommerce 1.7.5 - 1.9.7 - Unauthenticated Order Status Forgery via Shipment Webhook
The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of incoming shipment webhook requests, relying only on a non-secret identifier and an IP check that is not enforced, allowing unauthenticated attackers who know a target order's parcel tracking number to forge its shipme...
CVE-2026-93580 InPost for WooCommerce 1.7.5 - 1.9.7 - Unauthenticated Order Status Forgery via Shipment Webhook
The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of incoming shipment webhook requests, relying only on a non-secret identifier and an IP check that is not enforced, allowing unauthenticated attackers who know a target order's parcel tracking number to forge its shipme...
CVE-2026-93580
The InPost PL WordPress plugin (versions prior to 1.9.8 ) is vulnerable to unauthenticated order status forgery. The root cause is a failure to verify the authenticity of incoming shipment webhook requests; the plugin relies on a non-secret identifier and an unenforced IP check. This allows an un...
CVE-2026-85573
The All in One Files Upload WordPress plugin (specifically for WooCommerce ), versions 2.0.3 through 2.0.16 , is vulnerable to unauthenticated stored XSS . The root cause is that the plugin adds SVG to allowed upload types but fails to sanitize uploaded files or verify the authenticity of public ...
CVE-2026-85576
The All in One Files Upload WordPress plugin, specifically versions before 2.0.17 , is vulnerable to an unauthorized settings modification. The root cause is a lack of capability checks and a failure to verify the authenticity of the request when saving plugin settings. This flaw allows any authe...
CVE-2026-85576 All in One Files Upload for WooCommerce < 2.0.17 - Subscriber+ Arbitrary Plugin Settings Update
The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving its settings, allowing any authenticated user, such as a subscriber, to change them...
CVE-2026-85573 All in One Files Upload for WooCommerce 2.0.3 - 2.0.16 - Unauthenticated Stored XSS via SVG Upload
The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authenticity of its public upload requests, allowing unauthenticated users to store files containing active content which run in the site's...
CVE-2026-85576 All in One Files Upload for WooCommerce < 2.0.17 - Subscriber+ Arbitrary Plugin Settings Update
The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving its settings, allowing any authenticated user, such as a subscriber, to change them...
CVE-2026-85573 All in One Files Upload for WooCommerce 2.0.3 - 2.0.16 - Unauthenticated Stored XSS via SVG Upload
The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authenticity of its public upload requests, allowing unauthenticated users to store files containing active content which run in the site's...
PT-2026-103263
Author Cross Site Scripting XSS in YITH WooCommerce Tab Manager = 2.15.0 versions...
CVE-2026-97272: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Premmerce Permalink Manager for WooCommerce = 2.3.13 versions...
CVE-2026-96823: Missing Authorization
Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce = 5.120.0 versions...