24480 matches found
WordPress Razorpay Payment Links for WooCommerce plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Oly Hossen in WordPress Plugin Razorpay Payment Links for WooCommerce versions = 2.1.5...
WordPress Premmerce Permalink Manager for WooCommerce plugin <= 2.3.13 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin Premmerce Permalink Manager for WooCommerce versions = 2.3.13...
CVE-2026-93580 InPost for WooCommerce 1.7.5 - 1.9.7 - Unauthenticated Order Status Forgery via Shipment Webhook
The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of incoming shipment webhook requests, relying only on a non-secret identifier and an IP check that is not enforced, allowing unauthenticated attackers who know a target order's parcel tracking number to forge its shipme...
CVE-2026-93580 InPost for WooCommerce 1.7.5 - 1.9.7 - Unauthenticated Order Status Forgery via Shipment Webhook
The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of incoming shipment webhook requests, relying only on a non-secret identifier and an IP check that is not enforced, allowing unauthenticated attackers who know a target order's parcel tracking number to forge its shipme...
CVE-2026-93580
The InPost PL WordPress plugin (versions prior to 1.9.8 ) is vulnerable to unauthenticated order status forgery. The root cause is a failure to verify the authenticity of incoming shipment webhook requests; the plugin relies on a non-secret identifier and an unenforced IP check. This allows an un...
CVE-2026-85573 All in One Files Upload for WooCommerce 2.0.3 - 2.0.16 - Unauthenticated Stored XSS via SVG Upload
The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authenticity of its public upload requests, allowing unauthenticated users to store files containing active content which run in the site's...
CVE-2026-85576 All in One Files Upload for WooCommerce < 2.0.17 - Subscriber+ Arbitrary Plugin Settings Update
The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving its settings, allowing any authenticated user, such as a subscriber, to change them...
CVE-2026-85573
The All in One Files Upload WordPress plugin (specifically for WooCommerce ), versions 2.0.3 through 2.0.16 , is vulnerable to unauthenticated stored XSS . The root cause is that the plugin adds SVG to allowed upload types but fails to sanitize uploaded files or verify the authenticity of public ...
CVE-2026-85573 All in One Files Upload for WooCommerce 2.0.3 - 2.0.16 - Unauthenticated Stored XSS via SVG Upload
The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authenticity of its public upload requests, allowing unauthenticated users to store files containing active content which run in the site's...
CVE-2026-85576
The All in One Files Upload WordPress plugin, specifically versions before 2.0.17 , is vulnerable to an unauthorized settings modification. The root cause is a lack of capability checks and a failure to verify the authenticity of the request when saving plugin settings. This flaw allows any authe...
CVE-2026-85576 All in One Files Upload for WooCommerce < 2.0.17 - Subscriber+ Arbitrary Plugin Settings Update
The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving its settings, allowing any authenticated user, such as a subscriber, to change them...
PT-2026-103181
Shop manager PHP Object Injection in Kadence WooCommerce Email Designer = 1.5.19.1 versions...
PT-2026-103266
Unauthenticated Cross Site Request Forgery CSRF in Razorpay Payment Links for WooCommerce = 2.1.5 versions...
CVE-2026-96823: Missing Authorization
Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce = 5.120.0 versions...
CVE-2026-96814: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in WooCommerce Product Table Lite = 5.6.7 versions...
CVE-2026-96817: Missing Authorization
Subscriber Broken Access Control in MakeCommerce for WooCommerce = 4.1.0 versions...
CVE-2026-96816: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Trusted Shops Easy Integration for WooCommerce = 2.0.6 versions...
CVE-2026-96352: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in YITH WooCommerce Ajax Search = 2.28.0 versions...
CVE-2026-96838: Cross-Site Request Forgery (CSRF)
Unauthenticated Cross Site Request Forgery CSRF in Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification = 2.3.1 versions...