19135 matches found
WordPress Paymob for WooCommerce plugin < 4.1.9 - Unauthenticated SQL Injection via Paymob Callback Pixel Lookup vulnerability
Unauthenticated SQL Injection via Paymob Callback Pixel Lookup vulnerability discovered by Artus KG in WordPress Plugin Paymob for WooCommerce versions 4.1.9...
WordPress TLP Food Menu plugin < 6.0.2 - Unauthenticated Reservation Status Modification vulnerability
Unauthenticated Reservation Status Modification vulnerability discovered by Vaibhav Narkhede in WordPress Plugin Food Menu – Restaurant Menu & Online Ordering for WooCommerce versions 6.0.2...
WordPress Payment Gateway for PayPal on WooCommerce plugin < 9.2.1 - Unauthenticated Payment Bypass via PayPal Advanced Return Handler vulnerability
Unauthenticated Payment Bypass via PayPal Advanced Return Handler vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Payment Gateway for PayPal on WooCommerce versions 9.2.1...
WordPress Wallet System for WooCommerce plugin < 2.7.10 - Customer+ Checkout Price Manipulation via Unvalidated Wallet Amount vulnerability
Customer+ Checkout Price Manipulation via Unvalidated Wallet Amount vulnerability discovered by takuma in WordPress Plugin Wallet System for WooCommerce versions 2.7.10...
WordPress Order Sync with Zendesk for WooCommerce plugin < 2.2.3 - Unauthenticated Customer Order Data Disclosure vulnerability
Unauthenticated Customer Order Data Disclosure vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Order Sync with Zendesk for WooCommerce versions 2.2.3...
WordPress WooCommerce Subscriptions plugin < 9.1.0 - Unauthenticated RCE via PHP Object Injection vulnerability
Unauthenticated RCE via PHP Object Injection vulnerability discovered by Vasily Belolapotkov, Vlad Olaru in WordPress Plugin WooCommerce Subscriptions versions 9.1.0...
CVE-2026-16739
The Epeken All Kurir for Woocommerce WordPress plugin through 2.1.2 does not verify that a payment-confirmation request originates from the owner of the targeted order, nor that any payment actually occurred, allowing unauthenticated attackers to mark arbitrary orders as confirmed and, in a...
CVE-2026-15205
The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows...
CVE-2026-16739
The Epeken All Kurir for Woocommerce WordPress plugin through 2.1.2 does not verify that a payment-confirmation request originates from the owner of the targeted order, nor that any payment actually occurred, allowing unauthenticated attackers to mark arbitrary orders as confirmed and, in a...
CVE-2026-16739 Epeken All Kurir <= 2.1.2 - Unauthenticated Order Payment Confirmation Forgery
The Epeken All Kurir for Woocommerce WordPress plugin through 2.1.2 does not verify that a payment-confirmation request originates from the owner of the targeted order, nor that any payment actually occurred, allowing unauthenticated attackers to mark arbitrary orders as confirmed and, in a...
CVE-2026-15205
The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows...
CVE-2026-15205
The CVE concerns the Paymob for WooCommerce WordPress plugin (versions
EUVD-2026-58596
The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows...
CVE-2026-15205 Paymob for WooCommerce < 4.1.9 - Unauthenticated SQL Injection via Paymob Callback Pixel Lookup
The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows...
EUVD-2026-58597
The Epeken All Kurir for Woocommerce WordPress plugin through 2.1.2 does not verify that a payment-confirmation request originates from the owner of the targeted order, nor that any payment actually occurred, allowing unauthenticated attackers to mark arbitrary orders as confirmed and, in a...
CVE-2026-16739
The CVE concerns the WordPress plugin Epeken All Kurir for WooCommerce, affected
CVE-2026-28154 WordPress Samex and M.Anh WordPress themes affected by Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme and snstheme M.Anh - Fashion WooCoommerce WordPress Theme allows Reflected XSS. This issue affects Samex - Clean, Minimal Shop...
EUVD-2026-58084
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme and snstheme M.Anh - Fashion WooCoommerce WordPress Theme allows Reflected XSS. This issue affects Samex - Clean, Minimal Shop...
CVE-2026-28154
CVE-2026-28154 concerns reflected Cross-Site Scripting (XSS) in two WordPress themes: Samex - Clean, Minimal Shop WooCommerce Theme (affected up to version 2.5) and M.Anh - Fashion WooCommerce Theme (affected up to version 1.7). The issue arises from improper input neutralization during web page ...