24607 matches found
CVE-2026-91019
The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys...
CVE-2026-91008
The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownership or authorization check before rendering booking confirmation details, allowing unauthenticated attackers to retrieve registered attendees' personal information full name, email address, phone...
CVE-2026-91009
The Active Woot Products Tables for WooCommerce. 100% FREE WordPress plugin before 2.1.3 does not have authorisation and CSRF checks in some of its AJAX actions, allowing any authenticated users, such as subscriber, to change the title of arbitrary posts, pages and products...
CVE-2026-91019 Event Booking Manager for WooCommerce < 5.6.0 - Contributor+ Payment Gateway Credential Disclosure
The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys...
CVE-2026-91019
The Event Booking Manager for WooCommerce WordPress plugin (also referred to as WpEvently ) versions prior to 5.6.0 is vulnerable to an improper access control flaw. The plugin fails to restrict access to its stored payment gateway configurations, allowing users with Contributor-level access or h...
CVE-2026-91019 Event Booking Manager for WooCommerce < 5.6.0 - Contributor+ Payment Gateway Credential Disclosure
The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys...
WordPress Event Booking Manager for WooCommerce plugin < 5.6.0 - Contributor+ Payment Gateway Credential Disclosure vulnerability
Contributor+ Payment Gateway Credential Disclosure vulnerability discovered by Artus KG in WordPress Plugin WpEvently versions 5.6.0...
WordPress Active Woot Products Tables for WooCommerce. 100% FREE plugin 2.1.2 - Subscriber+ Arbitrary Post Title Modification vulnerability
Subscriber+ Arbitrary Post Title Modification vulnerability discovered by JunHee CHO in WordPress Plugin Active Products Tables for WooCommerce versions 2.1.2...
CVE-2026-91008 Event Booking Manager for WooCommerce < 5.3.8 - Unauthenticated Attendee PII Disclosure via Booking Confirmation Panel
The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownership or authorization check before rendering booking confirmation details, allowing unauthenticated attackers to retrieve registered attendees' personal information full name, email address, phone...
CVE-2026-91008
The Event Booking Manager for WooCommerce WordPress plugin, in versions prior to 5.3.8 , is vulnerable to an unauthenticated attendee PII disclosure . The flaw exists because the plugin fails to perform adequate ownership or authorization checks before rendering booking confirmation details. An a...
CVE-2026-91009 Active Products Tables for WooCommerce < 2.1.3 - Subscriber+ Arbitrary Post Title Modification via woot_update_attachment
The Active Woot Products Tables for WooCommerce. 100% FREE WordPress plugin before 2.1.3 does not have authorisation and CSRF checks in some of its AJAX actions, allowing any authenticated users, such as subscriber, to change the title of arbitrary posts, pages and products...
CVE-2026-91008 Event Booking Manager for WooCommerce < 5.3.8 - Unauthenticated Attendee PII Disclosure via Booking Confirmation Panel
The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownership or authorization check before rendering booking confirmation details, allowing unauthenticated attackers to retrieve registered attendees' personal information full name, email address, phone...
EUVD-2026-81352
The Active Woot Products Tables for WooCommerce. 100% FREE WordPress plugin before 2.1.3 does not have authorisation and CSRF checks in some of its AJAX actions, allowing any authenticated users, such as subscriber, to change the title of arbitrary posts, pages and products...
CVE-2026-91009
The Active Woot Products Tables for WooCommerce. 100% FREE WordPress plugin (versions before 2.1.3 ) is vulnerable to unauthorized actions due to missing authorisation and CSRF checks in specific AJAX actions. This flaw allows any authenticated user, such as a subscriber , to modify the titles of...
CVE-2026-85128 Choose User Role at Registration for WooCommerce < 1.3.3 - Unauthenticated Privilege Escalation via Registration Role Request
The Choose User Role at Registration WordPress plugin before 1.3.3 does not validate the role requested at registration against the roles an administrator chose to offer, allowing unauthenticated users to request any role, including administrator, and to be granted it once the request is approved...
CVE-2026-85128
The Choose User Role at Registration WordPress plugin, in versions prior to 1.3.3 , is susceptible to an unauthenticated privilege escalation vulnerability. The root cause is a failure to validate requested roles against the specific roles an administrator has chosen to offer during registration....
CVE-2026-91019: Improper Access Control
The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys...
CVE-2026-87831: Missing Authorization
The Checkout Field Manager Checkout Manager for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer to delete arbitrary media attachments belonging to other users...
CVE-2026-91017: Insufficient Verification of Data Authenticity
The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notifications when its non-default deferred-payment feature is enabled, allowing unauthenticated attackers to forge a notification and mark arbitrary WooCommerce orders...