CVE-2026-18945

The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX actions, allowing unauthenticated users to view other customers' order details, including personal information, as well as change t...

CVE-2026-19088

The CVE-2026-19088 affects the ShopEngine Elementor WooCommerce Builder Addon for WordPress (older than 4.9.3). The issue is an CSRF vulnerability on an authentication endpoint, which can allow an attacker to log a victim into an attacker-controlled account. As a consequence, billing and shipping...

EUVD-2026-57729

The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout...

CVE-2026-18945 WP Helper Premium < 4.7.6 - Unauthenticated Order Data Disclosure and Order Manipulation via Missing Order Key Validation

The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX actions, allowing unauthenticated users to view other customers' order details, including personal information, as well as change t...

EUVD-2026-57728

The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX actions, allowing unauthenticated users to view other customers' order details, including personal information, as well as change t...

CVE-2026-14182 Customer Email Verification for WooCommerce < 3.2.6 - Unauthenticated Account Takeover via Type-Juggling Authentication Bypass

The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the accoun...

CVE-2026-14182

The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the accoun...

EUVD-2026-57726

The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the accoun...

CVE-2026-14182

The CVE-2026-14182 affects the Customer Email Verification for WooCommerce WordPress plugin prior to 3.2.6. The vulnerability stems from incorrect validation of the email-verification activation code, using a loose (type-j juggling) comparison that a crafted value can satisfy. This allows unauthe...

PT-2026-71503

Unauthenticated Privilege Escalation in MStore API = 4.20.0 versions...

PT-2026-71601

Administrator SQL Injection in MailChimp For WooCommerce 6.2 versions...

PT-2026-71554

Unauthenticated Broken Access Control in MultiVendorX = 5.0.10 versions...

PT-2026-71551

Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce via CLINK = 1.0.7 versions...

PT-2026-71568

Unauthenticated Sensitive Data Exposure in WooCommerce Appointments = 5.3.8 versions...

PT-2026-71574

Unauthenticated Cross Site Scripting XSS in Local Delivery Drivers for WooCommerce = 3.0.0 versions...

PT-2026-71496

Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce = 2.0.3 versions...

WordPress Revolut Gateway for WooCommerce plugin < 4.22.10 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Lee chul woong in WordPress Plugin Revolut Gateway for WooCommerce versions 4.22.10...

CVE-2026-16621

The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that payment actually succeeded before completing an order in its PayPal return handler: it reads attacker-controlled parameters, performs no amount comparison and no order-ownership check, and completes t...

CVE-2026-15045

The Wallet System for WooCommerce WordPress plugin before 2.7.10 does not validate a user-supplied wallet amount against the customer's actual stored balance during checkout, allowing authenticated customers to arbitrarily reduce their own order total, including down to zero, and complete checkou...

CVE-2026-16621 Payment Gateway for PayPal on WooCommerce < 9.2.1 - Unauthenticated Payment Bypass via PayPal Advanced Return Handler

The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that payment actually succeeded before completing an order in its PayPal return handler: it reads attacker-controlled parameters, performs no amount comparison and no order-ownership check, and completes t...