CVE-2026-92404 MgoSync 2.1.5 - 2.1.6 - Unauthenticated WooCommerce API Credential Disclosure

The MgoSync WordPress plugin before 2.1.7 does not have authorization controls on one of its REST API endpoints, allowing unauthenticated users to retrieve the stored WooCommerce API credentials, including a read/write consumer key and secret, from a configured site...

CVE-2026-92404

The MgoSync WordPress plugin versions 2.1.5 through 2.1.6 is vulnerable to an unauthenticated WooCommerce API Credential Disclosure vulnerability. Due to a lack of authorization controls on a specific REST API endpoint , an unauthenticated user can retrieve stored WooCommerce API credentials, inc...

CVE-2026-92404 MgoSync 2.1.5 - 2.1.6 - Unauthenticated WooCommerce API Credential Disclosure

The MgoSync WordPress plugin before 2.1.7 does not have authorization controls on one of its REST API endpoints, allowing unauthenticated users to retrieve the stored WooCommerce API credentials, including a read/write consumer key and secret, from a configured site...

PT-2026-95797

Name of the Vulnerable Software and Affected Versions Payment Gateway of Stripe for WooCommerce versions prior to 5.0.9 Description Improper Verification of Cryptographic Signature occurs due to the woocommerce api wt stripe webhook endpoint EH Stripe Webhook Handler::handle failing to execute th...

PT-2026-95777

Name of the Vulnerable Software and Affected Versions AppMySite – WordPress & WooCommerce Mobile App Builder versions prior to 3.15.4 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with Subscriber-level access and...

CVE-2026-12402: Improper Neutralization of Input During Web Page Generation

The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fb-config' Setting in all versions up to, and including, 2.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-9766: Missing Authorization

The Empik for Woocommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVE-2026-92435: Missing Authorization

The Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that the requesting user holds the required capability in the permission callback for several of its REST API routes, allowing unauthenticated users to reach administrator-oriented endpoints and trigger a persistent state...

CVE-2026-92430: Missing Authorization

The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the authenticity of its PIX payment webhook before updating an order's status, allowing unauthenticated attackers to mark a pending order as paid without paying...

CVE-2026-11899: Missing Authorization

The PDF Builder for WooCommerce. Create invoices,packing slips and more plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.0.11. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible...

CVE-2026-92404: Exposure of Sensitive Information to an Unauthorized Actor

The MgoSync WordPress plugin before 2.1.7 does not have authorization controls on one of its REST API endpoints, allowing unauthenticated users to retrieve the stored WooCommerce API credentials, including a read/write consumer key and secret, from a configured site...

CVE-2026-9858: Missing Authorization

The Partial Shipment for Woocommerce plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.4 via the wxpordershipment, wxporderitemshipment, and wxpordersetshipped AJAX actions. This is due to the AJAX handlers in woocommerce-partial-shipment.php register...

CVE-2026-9613: Missing Authorization

The Datalogics Ecommerce Delivery – Datalogics plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.65. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...

CVE-2026-75959: Improper Neutralization of Special Elements used in an SQL Command

The GoPay for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'logtablefilter' parameter in all versions up to, and including, 1.0.36 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This make...

CVE-2026-13770: Improper Neutralization of Input During Web Page Generation

The AppMySite – WordPress & WooCommerce Mobile App Builder No-Code Android & iOS App Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via saveamslicensekey AJAX Handler in all versions up to, and including, 3.15.3 due to insufficient input sanitization and output escaping...

CVE-2026-9832: Improper Verification of Cryptographic Signature

The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in all versions up to, and including, 5.0.8. This is due to the publicly accessible woocommerceapiwtstripe webhook endpoint EHStripeWebhookHandler::handle wrapping...

PT-2026-95773

Name of the Vulnerable Software and Affected Versions OTP Login & Register Woocommerce versions prior to 2.7.4 Description Insufficient input sanitization and output escaping in the fb-config setting allow authenticated attackers with administrator-level access or higher to perform Stored...

PT-2026-95765

Name of the Vulnerable Software and Affected Versions MgoSync WordPress plugin versions prior to 2.1.7 Description The plugin lacks authorization controls on a REST API endpoint, which enables unauthenticated users to retrieve stored WooCommerce API credentials. This includes the read/write...

PT-2026-95772

Name of the Vulnerable Software and Affected Versions PDF Builder for WooCommerce. Create invoices,packing slips and more versions prior to 2.0.12 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions...

PT-2026-95769

Name of the Vulnerable Software and Affected Versions Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin versions prior to 5.4.7 Description The plugin fails to verify the authenticity of its PIX payment webhook before updating the status of an order. This allows...