CVE-2026-82215

The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before acting on them, allowing unauthenticated attackers who know the store's merchant identifier to mark arbitrary orders as paid, or to cancel...

CVE-2026-82215

The Payment Gateway PayPay for WooCommerce WordPress plugin (versions 0.5 through 0.9.3) fails to verify the authenticity of incoming payment notification webhooks before acting on them. An unauthenticated attacker who knows a store's merchant identifier can mark arbitrary orders as paid , or can...

EUVD-2026-76038

The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before acting on them, allowing unauthenticated attackers who know the store's merchant identifier to mark arbitrary orders as paid, or to cancel...

CVE-2026-82215 WC PayPay Gateway 0.5 - 0.9.3 - Unauthenticated Payment Bypass via Unverified Webhook

The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before acting on them, allowing unauthenticated attackers who know the store's merchant identifier to mark arbitrary orders as paid, or to cancel...

WordPress Payment Gateway PayPay for WooCommerce plugin 0.5-0.9.3 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by Pedro Pinho in WordPress Plugin Payment Gateway PayPay for WooCommerce versions 0.5-0.9.3...

CVE-2026-82215 WC PayPay Gateway 0.5 - 0.9.3 - Unauthenticated Payment Bypass via Unverified Webhook

The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before acting on them, allowing unauthenticated attackers who know the store's merchant identifier to mark arbitrary orders as paid, or to cancel...

WordPress Ultimate Gift Cards For WooCommerce plugin < 3.2.10 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Ultimate Gift Cards For WooCommerce versions 3.2.10...

WordPress Themify - WooCommerce Product Filter plugin <= 1.5.5 - Reflected Cross-Site Scripting vulnerability

WordPress Themify - WooCommerce Product Filter plugin = 1.5.5 - Reflected Cross-Site Scripting vulnerability discovered by Adrien Brunner in WordPress Plugin Themify – WooCommerce Product Filter versions = 1.5.5...

WordPress zipMoney(Zip Co) Payments Plugin for WooCommerce plugin < 2.4.0 - Unauthenticated Arbitrary Option Deletion vulnerability

Unauthenticated Arbitrary Option Deletion vulnerability discovered by Naoki Kawahigashi in WordPress Plugin zipMoneyZip Co Payments Plugin for WooCommerce versions 2.4.0...

CVE-2026-14562

The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not perform any authorization or ownership checks before returning WooCommerce order metadata and the URLs of customer-uploaded attachments, allowing unauthenticated attackers to disclose other customers' order and attachment data...

CVE-2026-82305

The YITH WooCommerce Wishlist WordPress plugin before 4.18.1 does not verify that a user is authorised to rename a given wishlist, allowing unauthenticated users to rename any wishlist on the site...

CVE-2026-14566

The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before updating WooCommerce order item metadata for a supplied order, allowing any authenticated user such as a subscriber to tamper with the custom metadata of orders belongi...

WordPress OTP Login & Register Woocommerce plugin <= 2.7.2 - Unauthenticated Authentication Bypass via Brute Force vulnerability

Unauthenticated Authentication Bypass via Brute Force vulnerability discovered by d4ngvn in WordPress Plugin OTP Login Woocommerce & Gravity Forms versions = 2.7.2...

EUVD-2026-75963

The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before updating WooCommerce order item metadata for a supplied order, allowing any authenticated user such as a subscriber to tamper with the custom metadata of orders belongi...

CVE-2026-14566 Advanced Customized Prompts <= 1.0.1 - Subscriber+ WooCommerce Order Item Metadata Tampering

The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before updating WooCommerce order item metadata for a supplied order, allowing any authenticated user such as a subscriber to tamper with the custom metadata of orders belongi...

EUVD-2026-75965

The YITH WooCommerce Wishlist WordPress plugin before 4.18.1 does not verify that a user is authorised to rename a given wishlist, allowing unauthenticated users to rename any wishlist on the site...

CVE-2026-82305

The YITH WooCommerce Wishlist WordPress plugin (versions before 4.18.1 ) contains an authorization bypass vulnerability. The flaw exists because the plugin fails to verify if a user is authorized to rename a wishlist, specifically via the change_wishlist_title functionality. This allows unauthent...

CVE-2026-14566

The advanced-customized-prompts WordPress plugin (versions

CVE-2026-14566 Advanced Customized Prompts <= 1.0.1 - Subscriber+ WooCommerce Order Item Metadata Tampering

The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before updating WooCommerce order item metadata for a supplied order, allowing any authenticated user such as a subscriber to tamper with the custom metadata of orders belongi...

CVE-2026-82305 YITH WooCommerce Wishlist < 4.18.1 - Unauthenticated Arbitrary Wishlist Rename via change_wishlist_title

The YITH WooCommerce Wishlist WordPress plugin before 4.18.1 does not verify that a user is authorised to rename a given wishlist, allowing unauthenticated users to rename any wishlist on the site...