PT-2026-103490

Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields = 3.3.8 versions...

WordPress WPML Multilingual & Multicurrency for WooCommerce plugin <= 5.5.7 - Authenticated (Shop Manager+) SQL Injection vulnerability

Authenticated Shop Manager+ SQL Injection vulnerability discovered by Muni Nitish Kumar Yaddala Stranger825 in WordPress Plugin WooCommerce Multilingual & Multicurrency versions = 5.5.7...

PT-2026-103254

Unauthenticated Cross Site Scripting XSS in Premmerce Permalink Manager for WooCommerce = 2.3.13 versions...

PT-2026-103159

Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce = 2.1.2 versions...

PT-2026-103199

Unauthenticated Cross Site Scripting XSS in WooCommerce Product Table Lite = 5.6.7 versions...

CVE-2026-97299: Cross-Site Request Forgery (CSRF)

Unauthenticated Cross Site Request Forgery CSRF in Razorpay Payment Links for WooCommerce = 2.1.5 versions...

CVE-2026-97292: Improper Neutralization of Input During Web Page Generation

Author Cross Site Scripting XSS in YITH WooCommerce Tab Manager = 2.15.0 versions...

CVE-2026-97272: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Premmerce Permalink Manager for WooCommerce = 2.3.13 versions...

CVE-2026-97259: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in WP Hosting AS Pay with Vipps for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.4...

CVE-2026-96838: Cross-Site Request Forgery (CSRF)

Unauthenticated Cross Site Request Forgery CSRF in Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification = 2.3.1 versions...

CVE-2026-96828: Improper Neutralization of Special Elements used in an SQL Command

Administrator SQL Injection in Category Discount Woocommerce = 5.18 versions...

CVE-2026-96817: Missing Authorization

Subscriber Broken Access Control in MakeCommerce for WooCommerce = 4.1.0 versions...

CVE-2026-96816: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Trusted Shops Easy Integration for WooCommerce = 2.0.6 versions...

CVE-2026-96814: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in WooCommerce Product Table Lite = 5.6.7 versions...

CVE-2026-96352: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in YITH WooCommerce Ajax Search = 2.28.0 versions...

CVE-2026-94674: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Pixel Manager for WooCommerce = 1.69.0 versions...

CVE-2026-93771: Deserialization of Untrusted Data

Shop manager PHP Object Injection in Cost of Goods for WooCommerce = 3.5.2 versions...

CVE-2026-93624: Deserialization of Untrusted Data

Shop manager PHP Object Injection in Music Player for WooCommerce = 1.9.1 versions...

CVE-2026-93651: Deserialization of Untrusted Data

Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce = 2.1.2 versions...

CVE-2026-102392: Deserialization of Untrusted Data

Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields = 3.3.8 versions...