CVE-2026-87869 Filter Everything — WordPress & WooCommerce Filters <= 1.9.6 - Reflected Cross-Site Scripting via Elementor Posts Widget Pagination URL

The Filter Everything — WordPress & WooCommerce Filters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.9.6. This is due to insufficient input sanitization and output escaping in the flrtelementorloadmoreanchor function. The function reads...

EUVD-2026-96055

The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2 via the 'xpvimage' parameter parameter. This is due to missing authentication and nonce checks on the wploaded handler combined with no sanitization...

CVE-2026-103889

The 3D Product configurator for WooCommerce plugin for WordPress (versions

CVE-2023-28121

CVE-2023-28121 WooCommerce Payments: 무단 관리자 접근 익스플로잇 이건 먼저 공개하지 않을 거야... 그건 확실해.. PoC가 이제 공개되었습니다. 교육/연구 목적으로만 제작되었습니다! 사용에 따른 책임은 본인에게 있습니다!...

WooRefer

WooRefer | CVE-2022-4047 - WooCommerce용 반품 환불 및 교환 CVE-2022-4047 - WooCommerce용 반품 환불 및 교환 install.sh sha1sum install.sh | grep 12345678 md5sum install.sh sha512sum install.sh bash install.sh 사용 방법 Parallel이 이미 설치되어 있는지 확인하세요! 그런 다음 실행: git clone https://github.com/im-hanzou/WooRefer.git cd...

CVE-2026-49777

CVE-2026-49777 CVE-2026-49777 - ShapedPlugin Product Slider Pro for WooCommerce 백도어 RCE 심층 기술 분석: Product Slider Pro 백도어 취약점 취약성 근거 및 원인 CWE-1284 취약성의 기술적 원인은 CWE-1284: "입력에서 지정된 수량의 부적절한 검증"으로 분류됩니다. 이는 소프트웨어가 사용자로부터 수량예: 크기, 길이, 숫자을 지정할 것으로 예상되는 입력을 받지만 이 입력을 적절히 검증하지 않음을 의미합니다. 공격자는 이 취약점을 악용하...

CVE-2024-50508

CVE-2024-50508 Woocommerce Product Design = 1.0.0 - 未认证的任意文件下载 描述 WordPress 的 Woocommerce Product Design 插件在 1.0.0（含）及之前的所有版本中均存在目录遍历漏洞。这使得未认证的攻击者能够读取服务器上任意文件的内容，其中可能包含敏感信息。 详情 类型 : 插件 标识 : woo-product-design 受影响版本 : 1.0.0 CVSS 分数 : 7.5 CVSS 评级 : 高 CVSS 向量 :...

PT-2026-109745

Unauthenticated Bypass Vulnerability in Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway = 1.7.2 versions...

WordPress Email Marketing for WordPress and WooCommerce – Retainful plugin <= 1.0.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Trithem in WordPress Plugin Email Marketing for WordPress and WooCommerce – Retainful versions = 1.0.10...

WordPress FunnelKit – Funnel Builder for WooCommerce Checkout plugin <= 3.16.0.5 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by crow in WordPress Plugin Funnel Builder by FunnelKit versions = 3.16.0.5...

WordPress WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin <= 5.0.2 - Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access vulnerability

Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access vulnerability discovered by Brian Mungai in WordPress Plugin WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels versions = 5.0.2...

CVE-2025-47577

CVE-2025-47577 - WordPress TI WooCommerce Wishlist 를 검사합니다 💾 유효한 업로드 이미지 URL을 result.txt에 저장합니다 💾 유효한 위시리스트 URL을 resultwishlist.txt에 저장합니다 🧠 연구자 출처: Patchstack Database 🚀 사용법 1. 대상 도메인 목록이 포함된 list.txt 파일을 준비합니다한 줄에 하나씩, http 제외. 2. 업로드할 파일예: hinata.jpg을 같은 폴더에 넣습니다. 3. 스크립트를 실행합니다: python3...

WordPress Payment Plugins for Stripe WooCommerce plugin <= 4.0.17 - Reflected DOM-Based Cross-Site Scripting vulnerability

Reflected DOM-Based Cross-Site Scripting vulnerability discovered by Adrien Brunner in WordPress Plugin Stripe For WooCommerce versions = 4.0.17...

WordPress PPOM – Product Addons & Custom Fields for WooCommerce plugin <= 34.0.10 - Unauthenticated Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion vulnerability discovered by whatm in WordPress Plugin PPOM for WooCommerce versions = 34.0.10...

WordPress FooSales – Point of Sale (POS) for WooCommerce plugin <= 1.43.0 - Authenticated (Custom+) Privilege Escalation vulnerability

Authenticated Custom+ Privilege Escalation vulnerability discovered by Supakiad S. m3ez in WordPress Plugin FooSales versions = 1.43.0...

WordPress Order Export & Order Import for WooCommerce plugin <= 2.7.8 - Unauthenticated Sensitive File Exposure vulnerability

Unauthenticated Sensitive File Exposure vulnerability discovered by Boluwatife Opeyemi tcyph3r in WordPress Plugin Order Export & Order Import for WooCommerce versions = 2.7.8...

WordPress Filter Everything — WordPress & WooCommerce Filters plugin <= 1.9.6 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Omar Elshopky 3l5h0pky in WordPress Plugin Filter Everything — WordPress & WooCommerce Filters versions = 1.9.6...

WordPress 3D Product configurator for WooCommerce plugin <= 2.16.2 - Unauthenticated Remote Code Execution vulnerability

Unauthenticated Remote Code Execution vulnerability discovered by Osman Hussein in WordPress Plugin 3D Product configurator for WooCommerce versions = 2.16.2...

CVE-2026-27540

🌐 Language / Dil 📌 概要 WooCommerce Wholesale Lead Capture WWLC — 認証不要のファイルアップロード → RCE | ---|--- 製品| WooCommerce Wholesale Lead Capture — wwlc プラグイン バージョン| ≤ 2.0.3.1 修正済み| 2.0.3.2+ — アップロードハンドラが保護済み 認証| 認証不要 ベクター| admin-ajax.php?action=wwlcfileuploadhandler フィールド| file multipart upload 書き込み先|...

CVE-2026-3891

🚀 CVE-2026-3891 – Pix for WooCommerce 인증되지 않은 파일 업로드 RCE CVE-2026-3891에 대한 개념 증명PoC 익스플로잇 – Pix for WooCommerce WordPress 플러그인≤ 1.5.0에서 원격 코드 실행으로 이어지는 인증되지 않은 임의 파일 업로드. 📖 개요 CVE-2026-3891 은 Pix for WooCommerce 플러그인의 치명적인 취약점으로, 1.5.0 까지의 모든 버전에 영향을 미칩니다. 이 플러그인은 AJAX 핸들러...