PT-2026-106481

Unauthenticated Settings Change in PayPlug for WooCommerce Official = 3.1.0 versions...

PT-2026-106479

Unauthenticated Cross Site Scripting XSS in WooCommerce Simple Auctions = 3.0.10 versions...

PT-2026-106460

Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API = 1.6.3 versions...

PT-2026-106337

Name of the Vulnerable Software and Affected Versions Fast Courier versions prior to 5.2.4 Description The Fast Courier WordPress plugin fails to restrict an unauthenticated REST route used for writing order fulfillment data. This allows unauthenticated attackers to overwrite the courier status a...

PT-2026-106328

Unauthenticated Broken Access Control in Morning for WooCommerce = 2.4.1 versions...

PT-2026-106325

Name of the Vulnerable Software and Affected Versions Faktur Pro for WooCommerce versions prior to 3.2.3 Description An authorization bypass exists due to incorrectly configured access control security levels. This allows for Insecure Direct Object References IDOR, a condition where an applicatio...

PT-2026-106432

Unauthenticated Cross Site Scripting XSS in Midtrans-WooCommerce = 2.32.3 versions...

PT-2026-106424

Unauthenticated Cross Site Scripting XSS in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart = 2.0.6 versions...

PT-2026-106406

Name of the Vulnerable Software and Affected Versions WooCommerce Lottery versions prior to 2.3.0 Description An unauthenticated SQL Injection exists in the software. SQL Injection is a type of vulnerability that allows an attacker to interfere with the queries that an application makes to its...

PT-2026-106395

Name of the Vulnerable Software and Affected Versions WooCommerce Appointments versions prior to 5.3.3 Description An unauthenticated SQL Injection exists in the software. SQL Injection is a type of vulnerability that allows an attacker to interfere with the queries that an application makes to i...

VulnCheck KEV: CVE-2026-93836

The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qty' parameter in all versions up to, and including, 8.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

PT-2026-106396

Name of the Vulnerable Software and Affected Versions WooCommerce Designer Pro versions prior to 1.9.34 Description A code injection issue allows users with low-privileged subscriber accounts to execute arbitrary code on the server. Recommendations Update to version 1.9.34 or later...

PT-2026-106435

Missing Authorization vulnerability in Patterns In The Cloud Autoship Cloud for WooCommerce Subscription Products autoship-cloud allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Autoship Cloud for WooCommerce Subscription Products: from n/a through 2.17.1...

PT-2026-106425

Unauthenticated Broken Access Control in PayPlug for WooCommerce Official = 3.1.0 versions...

CVE-2025-4336

eMagicOne Store Manager for WooCommerce 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo...

CVE-2026-93528

📌 CVE-2026-93528: Unauthenticated Order Data Disclosure in NP Quote Request for WooCommerce • Vulnerability Type: Sensitive Data Disclosure CWE-200 • Affected Software: woo-rfq-for-woocommerce 2.4.16 • Original Researcher: Murad Islamzada • Vendor: Neah Plugins Cyrus 1. Overview & Root Cause The...

CVE-2026-3891

CVE-2026-3891 — Pix for WooCommerce Unauthenticated File Upload RCE Nonce Leak → certificatecrtpath Upload → Code Execution Overview CVE-2026-3891 is a critical-severity CVSS 9.8 unauthenticated arbitrary file upload vulnerability in the Pix for WooCommerce WordPress plugin by linknacional versio...

CVE-2026-97275

Improper Validation of Specified Quantity in Input vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Input Data Manipulation.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC Builder: from n/a through 1.0....

CVE-2026-103349

Deserialization of Untrusted Data vulnerability in Rymera Web Co Product Feed PRO for WooCommerce woo-product-feed-pro allows Object Injection.This issue affects Product Feed PRO for WooCommerce: from n/a through 13.5.7...

CVE-2026-100515

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Reflected XSS.This issue affects Photo Reviews for WooCommerce: from n/a through 1.2.30...