CVE-2026-97259: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in WP Hosting AS Pay with Vipps for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.4...

CVE-2026-96838: Cross-Site Request Forgery (CSRF)

Unauthenticated Cross Site Request Forgery CSRF in Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification = 2.3.1 versions...

CVE-2026-96828: Improper Neutralization of Special Elements used in an SQL Command

Administrator SQL Injection in Category Discount Woocommerce = 5.18 versions...

CVE-2026-96817: Missing Authorization

Subscriber Broken Access Control in MakeCommerce for WooCommerce = 4.1.0 versions...

CVE-2026-96816: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Trusted Shops Easy Integration for WooCommerce = 2.0.6 versions...

CVE-2026-96814: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in WooCommerce Product Table Lite = 5.6.7 versions...

CVE-2026-96352: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in YITH WooCommerce Ajax Search = 2.28.0 versions...

CVE-2026-94674: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Pixel Manager for WooCommerce = 1.69.0 versions...

CVE-2026-93771: Deserialization of Untrusted Data

Shop manager PHP Object Injection in Cost of Goods for WooCommerce = 3.5.2 versions...

CVE-2026-93624: Deserialization of Untrusted Data

Shop manager PHP Object Injection in Music Player for WooCommerce = 1.9.1 versions...

CVE-2026-93651: Deserialization of Untrusted Data

Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce = 2.1.2 versions...

CVE-2026-102392: Deserialization of Untrusted Data

Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields = 3.3.8 versions...

CVE-2026-94677: Deserialization of Untrusted Data

Shop manager PHP Object Injection in Kadence WooCommerce Email Designer = 1.5.19.1 versions...

PT-2026-103222

Unauthenticated Cross Site Request Forgery CSRF in Blacklist Manager WooCommerce Anti-Fraud, Blacklist & Checkout Verification = 2.3.1 versions...

PT-2026-103212

Administrator SQL Injection in Category Discount Woocommerce = 5.18 versions...

CVE-2026-96823: Missing Authorization

Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce = 5.120.0 versions...

PT-2026-103263

Author Cross Site Scripting XSS in YITH WooCommerce Tab Manager = 2.15.0 versions...

PT-2026-103161

Shop manager PHP Object Injection in Cost of Goods for WooCommerce = 3.5.2 versions...

WordPress Music Player for WooCommerce plugin <= 1.9.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Music Player for WooCommerce versions = 1.9.1...

WordPress Blacklist Manager plugin 1.3.0-2.3.1 - Blocked User Restriction Bypass vulnerability

Blocked User Restriction Bypass vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Blacklist Manager WooCommerce Anti-Fraud, Blacklist & Checkout Verification versions 1.3.0-2.3.1...