Flexible Checkout Fields for WooCommerce <= 2.3.1 - Unauthenticated Arbitrary Plugin Settings Update

The Flexible Checkout Fields for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Arbitrary Plugin Settings update, in addition to Stored Cross-Site Scripting in versions up to, and including, 2.3.1. This is due to missing authorization checks on the updateSettingsAction function...

Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload

The Pix for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check and missing file type validation in the 'lknpixforwoocommercec6savesettings' function in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated...

Hippoo Mobile App for WooCommerce - Broken Access Control

Hippoo Mobile App for WooCommerce = 1.9.4 contains a broken access control vulnerability caused by incorrect privilege assignment, letting attackers escalate their privileges, exploit requires no special conditions. id: CVE-2026-49060 info: name: Hippoo Mobile App for WooCommerce - Broken Access...

BlueSnap Payment Gateway for WooCommerce <=3.4.0 - IPN Authorization Bypass

BlueSnap Payment Gateway for WooCommerce = 3.4.0 validates its unauthenticated IPN webhook using WooCommerce's client-IP geolocation, which trusts spoofed forwarding headers instead of requiring a webhook signature. Version 3.4.1 replaces the IP check with HMAC-SHA256 security headers. This...

CVE-2026-49777

CVE-2026-49777 CVE-2026-49777 - ثغرة باب خلفي في إضافة ShapedPlugin Product Slider Pro لووكومرس تؤدي إلى تنفيذ أوامر عن بُعد RCE تحليل تقني معمق: ثغرة الباب الخلفي في Product Slider Pro أساس الثغرة وسببها CWE-1284 يعود الأصل التقني للثغرة إلى تصنيف CWE-1284: "التحقق غير السليم من الكمية المحددة ف...

CVE-2024-50508

CVE-2024-50508 وضع تصميم منتج وووكوميرس = 1.0.0 - تنزيل ملف عشوائي غير مصادق عليه الوصف إن إضافة تصميم منتج وووكوميرس لووردبريس معرضة لثغرة اجتياز الدليل في جميع الإصدارات حتى 1.0.0. وهذا يتيح للمهاجمين غير المصادق عليهم قراءة محتويات ملفات عشوائية على الخادم، والتي قد تحتوي على معلومات حساسة...

WordPress Email Marketing for WordPress and WooCommerce – Retainful plugin <= 1.0.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Trithem in WordPress Plugin Email Marketing for WordPress and WooCommerce – Retainful versions = 1.0.10...

WordPress FunnelKit – Funnel Builder for WooCommerce Checkout plugin <= 3.16.0.5 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by crow in WordPress Plugin Funnel Builder by FunnelKit versions = 3.16.0.5...

WordPress WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin <= 5.0.2 - Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access vulnerability

Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access vulnerability discovered by Brian Mungai in WordPress Plugin WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels versions = 5.0.2...

CVE-2025-47577

CVE-2025-47577 - WordPress TI WooCommerce Wishlist pour le chemin de l'image téléchargée 💾 Sauvegarde les URLs d'images téléchargées valides dans result.txt...

WordPress Payment Plugins for Stripe WooCommerce plugin <= 4.0.17 - Reflected DOM-Based Cross-Site Scripting vulnerability

Reflected DOM-Based Cross-Site Scripting vulnerability discovered by Adrien Brunner in WordPress Plugin Stripe For WooCommerce versions = 4.0.17...

WordPress PPOM – Product Addons & Custom Fields for WooCommerce plugin <= 34.0.10 - Unauthenticated Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion vulnerability discovered by whatm in WordPress Plugin PPOM for WooCommerce versions = 34.0.10...

WordPress FooSales – Point of Sale (POS) for WooCommerce plugin <= 1.43.0 - Authenticated (Custom+) Privilege Escalation vulnerability

Authenticated Custom+ Privilege Escalation vulnerability discovered by Supakiad S. m3ez in WordPress Plugin FooSales versions = 1.43.0...

WordPress Order Export & Order Import for WooCommerce plugin <= 2.7.8 - Unauthenticated Sensitive File Exposure vulnerability

Unauthenticated Sensitive File Exposure vulnerability discovered by Boluwatife Opeyemi tcyph3r in WordPress Plugin Order Export & Order Import for WooCommerce versions = 2.7.8...

WordPress Filter Everything — WordPress & WooCommerce Filters plugin <= 1.9.6 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Omar Elshopky 3l5h0pky in WordPress Plugin Filter Everything — WordPress & WooCommerce Filters versions = 1.9.6...

WordPress 3D Product configurator for WooCommerce plugin <= 2.16.2 - Unauthenticated Remote Code Execution vulnerability

Unauthenticated Remote Code Execution vulnerability discovered by Osman Hussein in WordPress Plugin 3D Product configurator for WooCommerce versions = 2.16.2...

CVE-2026-27540

🌐 Language / Dil 📌 Özet WooCommerce Wholesale Lead Capture WWLC — Kimlik doğrulamasız dosya yükleme → RCE | ---|--- Ürün| WooCommerce Wholesale Lead Capture — wwlc eklentisi Sürüm| ≤ 2.0.3.1 Fixed| 2.0.3.2+ — upload handler korumalı Auth| Unauthenticated Vektör|...

CVE-2026-3891

🚀 CVE-2026-3891 – RCE par téléversement de fichier non authentifié dans Pix for WooCommerce Exploit de preuve de concept pour CVE-2026-3891 – téléversement arbitraire de fichier non authentifié menant à une exécution de code à distance dans le plugin WordPress Pix for WooCommerce ≤ 1.5.0. 📖 Aperç...

WordPress SKU Error Fixer for WooCommerce plugin <= 1.0 - Unauthenticated Orphaned Product Variation Deletion vulnerability

Unauthenticated Orphaned Product Variation Deletion vulnerability discovered by Naoki Kawahigashi in WordPress Plugin SKU Error Fixer for WooCommerce versions = 1.0...

CVE-2026-89055

CVE-2026-89055 — Contournement d'autorisation dans Customer Reviews for WooCommerce CusRev PoC Python 3 pour CVE-2026-89055 dans Customer Reviews for WooCommerce customer-reviews-woocommerce / Ivole CusRev. Description PoCbit / GitHub CVE-2026-89055 — Customer Reviews for WooCommerce CusRev ≤...