CVE-2026-49777

CVE-2026-49777 CVE-2026-49777 - ShapedPlugin Product Slider Pro for WooCommerce Backdoor RCE In-Depth Technical Analysis: Product Slider Pro Backdoor Vulnerability Vulnerability Basis and Cause CWE-1284 The technical origin of the vulnerability is classified as CWE-1284: "Improper Validation of...

CVE-2024-50508

CVE-2024-50508 Woocommerce Product Design = 1.0.0 - Download Arbitrario di File Non Autenticato Descrizione Il plugin Woocommerce Product Design per WordPress è vulnerabile a Directory Traversal in tutte le versioni fino alla 1.0.0 inclusa. Ciò consente ad attaccanti non autenticati di leggere il...

PT-2026-109745

Unauthenticated Bypass Vulnerability in Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway = 1.7.2 versions...

WordPress Email Marketing for WordPress and WooCommerce – Retainful plugin <= 1.0.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Trithem in WordPress Plugin Email Marketing for WordPress and WooCommerce – Retainful versions = 1.0.10...

WordPress FunnelKit – Funnel Builder for WooCommerce Checkout plugin <= 3.16.0.5 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by crow in WordPress Plugin Funnel Builder by FunnelKit versions = 3.16.0.5...

WordPress WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin <= 5.0.2 - Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access vulnerability

Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access vulnerability discovered by Brian Mungai in WordPress Plugin WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels versions = 5.0.2...

WordPress Payment Plugins for Stripe WooCommerce plugin <= 4.0.17 - Reflected DOM-Based Cross-Site Scripting vulnerability

Reflected DOM-Based Cross-Site Scripting vulnerability discovered by Adrien Brunner in WordPress Plugin Stripe For WooCommerce versions = 4.0.17...

WordPress PPOM – Product Addons & Custom Fields for WooCommerce plugin <= 34.0.10 - Unauthenticated Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion vulnerability discovered by whatm in WordPress Plugin PPOM for WooCommerce versions = 34.0.10...

WordPress FooSales – Point of Sale (POS) for WooCommerce plugin <= 1.43.0 - Authenticated (Custom+) Privilege Escalation vulnerability

Authenticated Custom+ Privilege Escalation vulnerability discovered by Supakiad S. m3ez in WordPress Plugin FooSales versions = 1.43.0...

WordPress Order Export & Order Import for WooCommerce plugin <= 2.7.8 - Unauthenticated Sensitive File Exposure vulnerability

Unauthenticated Sensitive File Exposure vulnerability discovered by Boluwatife Opeyemi tcyph3r in WordPress Plugin Order Export & Order Import for WooCommerce versions = 2.7.8...

WordPress Filter Everything — WordPress & WooCommerce Filters plugin <= 1.9.6 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Omar Elshopky 3l5h0pky in WordPress Plugin Filter Everything — WordPress & WooCommerce Filters versions = 1.9.6...

WordPress 3D Product configurator for WooCommerce plugin <= 2.16.2 - Unauthenticated Remote Code Execution vulnerability

Unauthenticated Remote Code Execution vulnerability discovered by Osman Hussein in WordPress Plugin 3D Product configurator for WooCommerce versions = 2.16.2...

CVE-2026-27540

🌐 Language / Dil 📌 Özet WooCommerce Wholesale Lead Capture WWLC — Caricamento file non autenticato → RCE | ---|--- Prodotto| WooCommerce Wholesale Lead Capture — plugin wwlc Versione| ≤ 2.0.3.1 Fixed| 2.0.3.2+ — upload handler protetto Auth| Unauthenticated Vettore|...

CVE-2026-3891

🚀 CVE-2026-3891 – Pix for WooCommerce: Caricamento File Non Autenticato e RCE Exploit Proof-of-Concept per CVE-2026-3891 – caricamento arbitrario di file non autenticato che porta all'esecuzione remota di codice nel plugin WordPress Pix for WooCommerce ≤ 1.5.0. 📖 Panoramica CVE-2026-3891 è una...

WordPress SKU Error Fixer for WooCommerce plugin <= 1.0 - Unauthenticated Orphaned Product Variation Deletion vulnerability

Unauthenticated Orphaned Product Variation Deletion vulnerability discovered by Naoki Kawahigashi in WordPress Plugin SKU Error Fixer for WooCommerce versions = 1.0...

CVE-2026-89055

CVE-2026-89055 — Customer Reviews for WooCommerce CusRev Authorization Bypass PoC in Python 3 per CVE-2026-89055 in Customer Reviews for WooCommerce customer-reviews-woocommerce / Ivole CusRev. Descrizione PoCbit / GitHub CVE-2026-89055 — Customer Reviews for WooCommerce CusRev ≤ 5.120.0 è...

CVE-2026-105872

Deserialization of Untrusted Data vulnerability in mklacroix Product Configurator for WooCommerce product-configurator-for-woocommerce allows Object Injection.This issue affects Product Configurator for WooCommerce: from n/a through 1.7.5...

WordPress Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway plugin <= 1.7.2 - Bypass Vulnerability vulnerability

Bypass Vulnerability vulnerability discovered by luffy in WordPress Plugin Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway versions = 1.7.2...

CVE-2026-103329

The Super Payments WordPress plugin before 1.43.1 does not properly verify the authenticity of incoming payment webhook notifications, as the signing key used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid signature and mark arbitrary...

CVE-2026-105872 WordPress Product Configurator for WooCommerce plugin <= 1.7.5 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in mklacroix Product Configurator for WooCommerce product-configurator-for-woocommerce allows Object Injection.This issue affects Product Configurator for WooCommerce: from n/a through 1.7.5...