CVE-2026-32580: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in WooCommerce Lottery = 2.2.9 versions...

CVE-2026-32557: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in WooCommerce Appointments = 5.3.2 versions...

CVE-2026-39723: Missing Authorization

Missing Authorization vulnerability in Green Invoice Morning for WooCommerce wc-gateway-greeninvoice allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Morning for WooCommerce: from n/a through 2.4.1...

CVE-2026-32576: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in ZWEISCHNEIDER Faktur Pro for WooCommerce woorechnung allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Faktur Pro for WooCommerce: from n/a through 3.2.2...

CVE-2026-39751: Missing Authorization

Unauthenticated Broken Access Control in PayPlug for WooCommerce Official = 3.1.0 versions...

CVE-2026-32578: Missing Authorization

Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce = 1.1.2606090 versions...

CVE-2026-32568: Improper Control of Generation of Code

Subscriber Remote Code Execution RCE in WooCommerce Designer Pro = 1.9.33 versions...

CVE-2026-39794: Missing Authorization

Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API = 1.6.3 versions...

CVE-2026-39762: Missing Authorization

Missing Authorization vulnerability in Patterns In The Cloud Autoship Cloud for WooCommerce Subscription Products autoship-cloud allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Autoship Cloud for WooCommerce Subscription Products: from n/a through 2.17.1...

CVE-2026-39758: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Midtrans-WooCommerce = 2.32.3 versions...

CVE-2026-42637: Missing Authorization

Unauthenticated Settings Change in PayPlug for WooCommerce Official = 3.1.0 versions...

PT-2026-106425

Unauthenticated Broken Access Control in PayPlug for WooCommerce Official = 3.1.0 versions...

PT-2026-106396

Name of the Vulnerable Software and Affected Versions WooCommerce Designer Pro versions prior to 1.9.34 Description A code injection issue allows users with low-privileged subscriber accounts to execute arbitrary code on the server. Recommendations Update to version 1.9.34 or later...

CVE-2026-97275

Improper Validation of Specified Quantity in Input vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Input Data Manipulation.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC Builder: from n/a through 1.0....

CVE-2026-103349

Deserialization of Untrusted Data vulnerability in Rymera Web Co Product Feed PRO for WooCommerce woo-product-feed-pro allows Object Injection.This issue affects Product Feed PRO for WooCommerce: from n/a through 13.5.7...

CVE-2026-100515

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Reflected XSS.This issue affects Photo Reviews for WooCommerce: from n/a through 1.2.30...

CVE-2026-103349 WordPress Product Feed PRO for WooCommerce plugin <= 13.5.7 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Rymera Web Co Product Feed PRO for WooCommerce woo-product-feed-pro allows Object Injection.This issue affects Product Feed PRO for WooCommerce: from n/a through 13.5.7...

EUVD-2026-92593

Deserialization of Untrusted Data vulnerability in Rymera Web Co Product Feed PRO for WooCommerce woo-product-feed-pro allows Object Injection.This issue affects Product Feed PRO for WooCommerce: from n/a through 13.5.7...

CVE-2026-103349

The Product Feed PRO for WooCommerce plugin (versions ≤ 13.5.7 ) by Rymera Web Co is vulnerable to PHP Object Injection due to the Deserialization of Untrusted Data (CWE-502). This flaw allows an attacker to inject objects into the application. While the CVSS 3.1 score is 7.2 (High) , the attack ...

CVE-2026-103349 WordPress Product Feed PRO for WooCommerce plugin <= 13.5.7 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Rymera Web Co Product Feed PRO for WooCommerce woo-product-feed-pro allows Object Injection.This issue affects Product Feed PRO for WooCommerce: from n/a through 13.5.7...