CVE-2026-85573 All in One Files Upload for WooCommerce 2.0.3 - 2.0.16 - Unauthenticated Stored XSS via SVG Upload

The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authenticity of its public upload requests, allowing unauthenticated users to store files containing active content which run in the site's...

CVE-2026-85576

The All in One Files Upload WordPress plugin, specifically versions before 2.0.17 , is vulnerable to an unauthorized settings modification. The root cause is a lack of capability checks and a failure to verify the authenticity of the request when saving plugin settings. This flaw allows any authe...

CVE-2026-85576 All in One Files Upload for WooCommerce < 2.0.17 - Subscriber+ Arbitrary Plugin Settings Update

The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving its settings, allowing any authenticated user, such as a subscriber, to change them...

PT-2026-103181

Shop manager PHP Object Injection in Kadence WooCommerce Email Designer = 1.5.19.1 versions...

PT-2026-103266

Unauthenticated Cross Site Request Forgery CSRF in Razorpay Payment Links for WooCommerce = 2.1.5 versions...

PT-2026-103201

Unauthenticated Cross Site Scripting XSS in Trusted Shops Easy Integration for WooCommerce = 2.0.6 versions...

PT-2026-103197

Unauthenticated Cross Site Scripting XSS in YITH WooCommerce Ajax Search = 2.28.0 versions...

PT-2026-103202

Subscriber Broken Access Control in MakeCommerce for WooCommerce = 4.1.0 versions...

PT-2026-103208

Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce = 5.120.0 versions...

PT-2026-103299

Authorization Bypass Through User-Controlled Key vulnerability in WP Hosting AS Pay with Vipps for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.4...

PT-2026-103180

Contributor Cross Site Scripting XSS in Pixel Manager for WooCommerce = 1.69.0 versions...

PT-2026-103158

Shop manager PHP Object Injection in Music Player for WooCommerce = 1.9.1 versions...

PT-2026-103490

Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields = 3.3.8 versions...

WordPress WPML Multilingual & Multicurrency for WooCommerce plugin <= 5.5.7 - Authenticated (Shop Manager+) SQL Injection vulnerability

Authenticated Shop Manager+ SQL Injection vulnerability discovered by Muni Nitish Kumar Yaddala Stranger825 in WordPress Plugin WooCommerce Multilingual & Multicurrency versions = 5.5.7...

PT-2026-103254

Unauthenticated Cross Site Scripting XSS in Premmerce Permalink Manager for WooCommerce = 2.3.13 versions...

PT-2026-103159

Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce = 2.1.2 versions...

PT-2026-103199

Unauthenticated Cross Site Scripting XSS in WooCommerce Product Table Lite = 5.6.7 versions...

CVE-2026-97299: Cross-Site Request Forgery (CSRF)

Unauthenticated Cross Site Request Forgery CSRF in Razorpay Payment Links for WooCommerce = 2.1.5 versions...

CVE-2026-97292: Improper Neutralization of Input During Web Page Generation

Author Cross Site Scripting XSS in YITH WooCommerce Tab Manager = 2.15.0 versions...

CVE-2026-97272: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Premmerce Permalink Manager for WooCommerce = 2.3.13 versions...