WordPress WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin <= 5.0.2 - Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access vulnerability

Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access vulnerability discovered by Brian Mungai in WordPress Plugin WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels versions = 5.0.2...

CVE-2025-47577

CVE-2025-47577 - WordPress TI WooCommerce Wishlist para ver la ruta de la imagen subida 💾 Guarda las URL de imágenes subidas válidas en result.txt 💾 Guarda las URL de wishlis...

WordPress Payment Plugins for Stripe WooCommerce plugin <= 4.0.17 - Reflected DOM-Based Cross-Site Scripting vulnerability

Reflected DOM-Based Cross-Site Scripting vulnerability discovered by Adrien Brunner in WordPress Plugin Stripe For WooCommerce versions = 4.0.17...

WordPress PPOM – Product Addons & Custom Fields for WooCommerce plugin <= 34.0.10 - Unauthenticated Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion vulnerability discovered by whatm in WordPress Plugin PPOM for WooCommerce versions = 34.0.10...

WordPress FooSales – Point of Sale (POS) for WooCommerce plugin <= 1.43.0 - Authenticated (Custom+) Privilege Escalation vulnerability

Authenticated Custom+ Privilege Escalation vulnerability discovered by Supakiad S. m3ez in WordPress Plugin FooSales versions = 1.43.0...

WordPress Order Export & Order Import for WooCommerce plugin <= 2.7.8 - Unauthenticated Sensitive File Exposure vulnerability

Unauthenticated Sensitive File Exposure vulnerability discovered by Boluwatife Opeyemi tcyph3r in WordPress Plugin Order Export & Order Import for WooCommerce versions = 2.7.8...

WordPress Filter Everything — WordPress & WooCommerce Filters plugin <= 1.9.6 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Omar Elshopky 3l5h0pky in WordPress Plugin Filter Everything — WordPress & WooCommerce Filters versions = 1.9.6...

WordPress 3D Product configurator for WooCommerce plugin <= 2.16.2 - Unauthenticated Remote Code Execution vulnerability

Unauthenticated Remote Code Execution vulnerability discovered by Osman Hussein in WordPress Plugin 3D Product configurator for WooCommerce versions = 2.16.2...

CVE-2026-27540

🌐 Idioma / Dil 📌 Resumen WooCommerce Wholesale Lead Capture WWLC — Carga de archivos sin autenticación → RCE | ---|--- Producto| WooCommerce Wholesale Lead Capture — plugin wwlc Versión| ≤ 2.0.3.1 Corregido| 2.0.3.2+ — manejador de carga protegido Auth| Sin autenticación Vector|...

CVE-2026-3891

🚀 CVE-2026-3891 – Subida de Archivos no Autenticada con RCE en Pix for WooCommerce Exploit de prueba de concepto para CVE-2026-3891 – subida arbitraria de archivos no autenticada que conduce a la ejecución remota de código en el plugin de WordPress Pix for WooCommerce ≤ 1.5.0. 📖 Resumen...

WordPress SKU Error Fixer for WooCommerce plugin <= 1.0 - Unauthenticated Orphaned Product Variation Deletion vulnerability

Unauthenticated Orphaned Product Variation Deletion vulnerability discovered by Naoki Kawahigashi in WordPress Plugin SKU Error Fixer for WooCommerce versions = 1.0...

CVE-2026-89055

CVE-2026-89055 — Customer Reviews for WooCommerce CusRev Omisión de Autorización PoC en Python 3 para CVE-2026-89055 en Customer Reviews for WooCommerce customer-reviews-woocommerce / Ivole CusRev. Descripción PoCbit / GitHub CVE-2026-89055 — Customer Reviews for WooCommerce CusRev ≤ 5.120.0 es...

CVE-2026-105872

Deserialization of Untrusted Data vulnerability in mklacroix Product Configurator for WooCommerce product-configurator-for-woocommerce allows Object Injection.This issue affects Product Configurator for WooCommerce: from n/a through 1.7.5...

CVE-2026-103329

The Super Payments WordPress plugin before 1.43.1 does not properly verify the authenticity of incoming payment webhook notifications, as the signing key used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid signature and mark arbitrary...

CVE-2026-105872

The Product Configurator for WooCommerce WordPress plugin (versions

EUVD-2026-95772

Deserialization of Untrusted Data vulnerability in mklacroix Product Configurator for WooCommerce product-configurator-for-woocommerce allows Object Injection.This issue affects Product Configurator for WooCommerce: from n/a through 1.7.5...

CVE-2026-103329

The Super Payments WordPress plugin (versions prior to 1.43.1 ) is vulnerable to an unauthenticated payment confirmation forgery . The flaw exists because the plugin fails to properly verify incoming payment webhook notifications, as the signing key used for signature validation is empty by defau...

CVE-2026-103329 Super Payments < 1.43.1 - Unauthenticated Payment Confirmation Forgery via Webhook Signature

The Super Payments WordPress plugin before 1.43.1 does not properly verify the authenticity of incoming payment webhook notifications, as the signing key used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid signature and mark arbitrary...

EUVD-2026-95709

The Super Payments WordPress plugin before 1.43.1 does not properly verify the authenticity of incoming payment webhook notifications, as the signing key used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid signature and mark arbitrary...

CVE-2026-18143

CVE-2026-18143 — Request a Quote for WooCommerce Addify Arbitrary File Upload Python 3 PoC for CVE-2026-18143 in Request a Quote for WooCommerce woocommerce-request-a-quote, Addify / WooCommerce.com. Description PoCbit / GitHub CVE-2026-18143 — Request a Quote for WooCommerce ≤ 2.9.2 allows...