CVE-2026-93928 WordPress Taxi Booking Manager for WooCommerce plugin < 2.0.8 - Broken Authentication vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce allows Authentication Bypass. This issue affects Taxi Booking Manager for WooCommerce: from n/a before 2.0.8...

CVE-2026-93928

CVE-2026-93928 is an Authentication Bypass Using an Alternate Path or Channel vulnerability in the Taxi Booking Manager for WooCommerce plugin by Magepeople Inc. , affecting versions before 2.0.8 . The vulnerability allows unauthenticated, network-based attackers to bypass authentication with low...

EUVD-2026-84337

Authentication Bypass Using an Alternate Path or Channel vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce allows Authentication Bypass. This issue affects Taxi Booking Manager for WooCommerce: from n/a before 2.0.8...

CVE-2026-15095 Product Feed Manager for WooCommerce <= 6.6.43 - Authenticated (Shop Manager+) Path Traversal to File Deletion via 'provider' Parameter

The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.6.43 via the 'provider' parameter. This makes it possible for authenticated attackers, with shop...

CVE-2026-15095 Product Feed Manager for WooCommerce <= 6.6.43 - Authenticated (Shop Manager+) Path Traversal to File Deletion via 'provider' Parameter

The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.6.43 via the 'provider' parameter. This makes it possible for authenticated attackers, with shop...

CVE-2026-15095

The Product Feed Manager for WooCommerce – CTX Feed plugin for WordPress is vulnerable to directory traversal in all versions up to and including 6.6.43 via the provider parameter. Authenticated attackers with Shop Manager or higher privileges can delete arbitrary files on the server by issuing t...

CVE-2026-93836

The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qty' parameter in all versions up to, and including, 8.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-92969

The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.4 via the 'shortcode' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files...

WordPress HUSKY – Products Filter for WooCommerce Professional plugin <= 1.4.4 - Unauthenticated Local File Inclusion vulnerability

Unauthenticated Local File Inclusion vulnerability discovered by crow in WordPress Plugin HUSKY versions = 1.4.4...

CVE-2026-93836 WPC Product Bundles for WooCommerce <= 8.6.6 - Unauthenticated Stored Cross-Site Scripting via 'qty' Parameter

The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qty' parameter in all versions up to, and including, 8.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

EUVD-2026-84310

The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qty' parameter in all versions up to, and including, 8.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-93836

The WPC Product Bundles for WooCommerce WordPress plugin is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) in all versions up to and including 8.6.6 . The root cause is a float cast used during quantity validation of the qty parameter, which allows numeric-prefixed payloads such ...

CVE-2026-93836 WPC Product Bundles for WooCommerce <= 8.6.6 - Unauthenticated Stored Cross-Site Scripting via 'qty' Parameter

The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qty' parameter in all versions up to, and including, 8.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-92969

The HUSKY – Products Filter for WooCommerce Professional WordPress plugin is vulnerable to Local File Inclusion in all versions up to and including 1.4.4 . The flaw resides in the 'shortcode' parameter passed via the woof_draw_products AJAX endpoint, specifically through the custom_tpl shortcode ...

CVE-2026-93836: Improper Neutralization of Input During Web Page Generation

The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qty' parameter in all versions up to, and including, 8.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-93928: Authentication Bypass Using an Alternate Path or Channel

Authentication Bypass Using an Alternate Path or Channel vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce allows Authentication Bypass. This issue affects Taxi Booking Manager for WooCommerce: from n/a before 2.0.8...

CVE-2026-92969: Improper Control of Filename for Include/Require Statement in PHP Program

The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.4 via the 'shortcode' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files...

CVE-2026-15095: Improper Limitation of a Pathname to a Restricted Directory

The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.6.43 via the 'provider' parameter. This makes it possible for authenticated attackers, with shop...

PT-2026-96683

Name of the Vulnerable Software and Affected Versions Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels versions prior to 6.6.44 Description A Directory Traversal issue exists where authenticated attackers with shop manager-level access or higher can delete...

PT-2026-96677

Name of the Vulnerable Software and Affected Versions HUSKY – Products Filter for WooCommerce Professional versions prior to 1.4.5 Description The plugin is subject to Local File Inclusion, a condition where an application includes files from the local file system without proper validation...