24599 matches found
CVE-2026-86796 WP Ghost (Hide My WP Ghost) 7.0.10 - Unauthenticated Firewall, Threat Detection and URL Hiding Bypass via WooCommerce Request Parameters
The Hide My WP Ghost WordPress plugin before 7.0.11 does not verify that a request is a genuine WooCommerce request before disabling its firewall, threat-detection and login/URL-hiding protections, treating the mere presence of an attacker-suppliable request parameter as sufficient, which allows...
CVE-2026-86796 WP Ghost (Hide My WP Ghost) 7.0.10 - Unauthenticated Firewall, Threat Detection and URL Hiding Bypass via WooCommerce Request Parameters
The Hide My WP Ghost WordPress plugin before 7.0.11 does not verify that a request is a genuine WooCommerce request before disabling its firewall, threat-detection and login/URL-hiding protections, treating the mere presence of an attacker-suppliable request parameter as sufficient, which allows...
CVE-2026-87770 Price Drop Alert for WooCommerce <= 1.1 - Unauthenticated SQL Injection via product
The Price Drop Alert for Woo Commerce WordPress plugin through 1.1 does not sanitize and escape parameters before using them in a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the...
CVE-2026-87770 Price Drop Alert for WooCommerce <= 1.1 - Unauthenticated SQL Injection via product
The Price Drop Alert for Woo Commerce WordPress plugin through 1.1 does not sanitize and escape parameters before using them in a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the...
CVE-2026-87770
The Price Drop Alert for WooCommerce WordPress plugin (versions
PT-2026-95284
Name of the Vulnerable Software and Affected Versions Printcart Web to Print Product Designer for WooCommerce versions prior to 2.8.6 Description This issue involves a Directory Traversal flaw that allows unauthenticated attackers to read arbitrary files on the server, potentially exposing...
CVE-2026-86796: Protection Mechanism Failure
The Hide My WP Ghost WordPress plugin before 7.0.11 does not verify that a request is a genuine WooCommerce request before disabling its firewall, threat-detection and login/URL-hiding protections, treating the mere presence of an attacker-suppliable request parameter as sufficient, which allows...
CVE-2026-92554: Improper Neutralization of Input During Web Page Generation
The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query-String Parameter Name in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping. This makes it...
CVE-2026-16777: Improper Limitation of a Pathname to a Restricted Directory
The Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.8.0 via the 'filename' parameter parameter. This makes it possible for authenticated attackers, with shop...
CVE-2026-14323: Improper Limitation of a Pathname to a Restricted Directory
The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.8.5 via the 'mockups' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server...
CVE-2026-18442: Improper Neutralization of Special Elements used in an SQL Command
The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wcfmmpuserlocationlng' parameter in all versions up to, and including, 3.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient...
PT-2026-95259
Name of the Vulnerable Software and Affected Versions Hide My WP Ghost versions prior to 7.0.11 Description The plugin fails to verify if a request is a genuine WooCommerce request before disabling its firewall, threat-detection, and login/URL-hiding protections. An unauthenticated attacker can...
Exploit for CVE-2026-27540
🌐 Language / Dil --- 📌 Özet Woo...
WordPress Custom Fields for WooCommerce plugin < 1.5.1 - Unauthenticated Arbitrary File Deletion via Path Traversal vulnerability
Unauthenticated Arbitrary File Deletion via Path Traversal vulnerability discovered by Mike Gozdiskowski in WordPress Plugin Custom Fields versions 1.5.1...
WordPress Event Booking Manager for WooCommerce (Pro) plugin <= 5.0.2 - Unauthenticated Price Manipulation vulnerability
Unauthenticated Price Manipulation vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Event Booking Manager for WooCommerce Pro versions = 5.0.2...
WordPress Easy Booking plugin < 3.5.0 - Unauthenticated Minimum Booking Duration Bypass vulnerability
Unauthenticated Minimum Booking Duration Bypass vulnerability discovered by marim00 in WordPress Plugin Easy Booking – WooCommerce Booking & Reservation Plugin versions 3.5.0...
CVE-2026-66631
Administrator SQL Injection in MC Woocommerce Wishlist = 1.9.21 versions...
EUVD-2026-81511
Administrator SQL Injection in MC Woocommerce Wishlist = 1.9.21 versions...