CVE-2026-80341: Incorrect Authorization

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not verify that a stored payment method belongs to the user attaching it, allowing any authenticated user, such as a subscriber, to bind another customer's stored card to their own account and then charge or delete it...

PT-2026-88861

The Payment Plugins for Stripe WooCommerce WordPress plugin before 4.0.12 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the billing details of any order, together with the secret that...

CVE-2026-14962: Improper Neutralization of Special Elements used in an SQL Command

The ELEX WooCommerce Request a Quote WordPress plugin before 2.4.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks and extract arbitrary data from the database...

CVE-2026-14359: Improper Privilege Management

The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 3.35.0. This is due to the adduserinwaitinglist function registered on the wpajaxyithwcwtladduser action being missing both a capability check and a nonce verificatio...

PT-2026-88887

The WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping plugin for WordPress is vulnerable to time-based SQL Injection via the 'feed' parameter in all versions up to, and including, 2.23.7 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-19802: Missing Authorization

The Checkout Custom Fields Builder for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...

PT-2026-88883

The Checkout Custom Fields Builder for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...

CVE-2026-19800: Improper Neutralization of Special Elements used in an SQL Command

The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to SQL Injection via the 'status' parameter in all versions up to, and including, 1.31.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-19778: Improper Neutralization of Special Elements used in an SQL Command

The WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping plugin for WordPress is vulnerable to time-based SQL Injection via the 'feed' parameter in all versions up to, and including, 2.23.7 due to insufficient escaping on the user supplied parameter and lack of...

PT-2026-88862

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the secret that gates access to any order and, through it, that...

PT-2026-88768

The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.1.10 via the value function. This is due to a trivially bypassable regex blacklist in Executer::allowedToR...

PT-2026-89262

Name of the Vulnerable Software and Affected Versions Direct Download for WooCommerce versions prior to 1.20 Description A Directory Traversal issue exists in the top-level include function. This allows unauthenticated attackers to read arbitrary files on the server, potentially exposing sensitiv...

WordPress WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping plugin <= 2.23.7 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin WooCommerce Google Feed Manager versions = 2.23.7...

WordPress Checkout Custom Fields Builder for WooCommerce plugin <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Plugin Installation vulnerability discovered by Nabil Irawan in WordPress Plugin Checkout Custom Fields Builder for WooCommerce versions = 1.1.5...

WordPress ilGhera Reviso Exporter for WooCommerce plugin <= 1.2.3 - Missing Authorization to Authenticated (Subscriber+) Agreement Grant Token Deletion via disconnect_callback Function vulnerability

Missing Authorization to Authenticated Subscriber+ Agreement Grant Token Deletion via disconnectcallback Function vulnerability discovered by Legion Hunter in WordPress Plugin ilGhera Reviso Exporter for WooCommerce versions = 1.2.3...

WordPress WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin <= 3.12.13 - Missing Authorization to Unauthenticated Arbitrary Product Price Manipulation vulnerability

Missing Authorization to Unauthenticated Arbitrary Product Price Manipulation vulnerability discovered by Wordfence PRISM in WordPress Plugin WPFunnels versions = 3.12.13...

WordPress Thank You Page Customizer for WooCommerce plugin <= 1.2.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Tony Harris in WordPress Plugin Thank You Page Customizer for WooCommerce versions = 1.2.2...

WordPress Return Refund and Exchange For WooCommerce plugin <= 4.6.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by babyhack@OPCIA in WordPress Plugin Return Refund and Exchange For WooCommerce versions = 4.6.4...

WordPress B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More plugin < 5.2.40 - Unauthenticated B2B Group Assignment and Approval Bypass vulnerability

Unauthenticated B2B Group Assignment and Approval Bypass vulnerability discovered by Farid Narimanov in WordPress Plugin B2BKing versions 5.2.40...

CVE-2026-81790

Missing Authorization vulnerability in Viszt Péter Csomagpontok és szállítási címkék WooCommerce-hez allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Csomagpontok és szállítási címkék WooCommerce-hez: from n/a before 4.2.8...