CVE-2026-97275 WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 - Bypass Vulnerability vulnerability

Improper Validation of Specified Quantity in Input vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Input Data Manipulation.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC Builder: from n/a through 1.0....

CVE-2026-97275

The VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin (versions n/a through 1.0.28 ) is vulnerable to Improper Validation of Specified Quantity in Input (CWE-1284). This flaw allows for Input Data Manipulation , which can be used to bypass intended logic within the ...

CVE-2026-97275 WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 - Bypass Vulnerability vulnerability

Improper Validation of Specified Quantity in Input vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Input Data Manipulation.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC Builder: from n/a through 1.0....

EUVD-2026-92589

Improper Validation of Specified Quantity in Input vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Input Data Manipulation.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC Builder: from n/a through 1.0....

CVE-2026-100515 WordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Reflected XSS.This issue affects Photo Reviews for WooCommerce: from n/a through 1.2.30...

CVE-2026-100515 WordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Reflected XSS.This issue affects Photo Reviews for WooCommerce: from n/a through 1.2.30...

CVE-2026-100515

The VillaTheme Photo Reviews for WooCommerce (woo-photo-reviews ) WordPress plugin is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. This issue affects versions up to and including 1.2.30 . Exploitation details are not provid...

EUVD-2026-92583

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Reflected XSS.This issue affects Photo Reviews for WooCommerce: from n/a through 1.2.30...

WordPress WooCommerce Multivendor Marketplace – REST API plugin <= 1.6.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Lee chul woong in WordPress Plugin WooCommerce Multivendor Marketplace – REST API versions = 1.6.3...

WordPress Autoship Cloud for WooCommerce Subscription Products plugin <= 2.17.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Averon Averenkov in WordPress Plugin Autoship Cloud for WooCommerce Subscription Products versions = 2.17.1...

WordPress WooCommerce Simple Auctions plugin <= 3.0.10 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin WooCommerce Simple Auctions versions = 3.0.10...

WordPress PayPlug for WooCommerce (Official) plugin <= 3.1.0 - Settings Change vulnerability

Settings Change vulnerability discovered by Filip Kecman in WordPress Plugin PayPlug for WooCommerce Official versions = 3.1.0...

CVE-2026-105421

Missing Authorization vulnerability in Kit Kit formerly ConvertKit for WooCommerce convertkit-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit formerly ConvertKit for WooCommerce: from n/a through 2.2.0...

WordPress StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Pedro Pinho in WordPress Plugin StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart versions = 2.0.6...

WordPress File Uploads Addon for WooCommerce plugin 1.7.2-1.7.6 - Unauthenticated Direct File Access vulnerability

Unauthenticated Direct File Access vulnerability discovered by J4ck13Ch4n in WordPress Plugin File Uploads Addon for WooCommerce versions 1.7.2-1.7.6...

WordPress File Uploads Addon for WooCommerce plugin 1.7.2-1.7.5 - Unauthenticated Customer Uploaded File Disclosure vulnerability

Unauthenticated Customer Uploaded File Disclosure vulnerability discovered by Erwan LR WPScan in WordPress Plugin File Uploads Addon for WooCommerce versions 1.7.2-1.7.5...

CVE-2026-105421 WordPress Kit (formerly ConvertKit) for WooCommerce plugin <= 2.2.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Kit Kit formerly ConvertKit for WooCommerce convertkit-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit formerly ConvertKit for WooCommerce: from n/a through 2.2.0...

EUVD-2026-92432

Missing Authorization vulnerability in Kit Kit formerly ConvertKit for WooCommerce convertkit-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit formerly ConvertKit for WooCommerce: from n/a through 2.2.0...

CVE-2026-105421

The WordPress Kit (formerly ConvertKit) for WooCommerce plugin (versions

CVE-2026-105421 WordPress Kit (formerly ConvertKit) for WooCommerce plugin <= 2.2.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Kit Kit formerly ConvertKit for WooCommerce convertkit-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit formerly ConvertKit for WooCommerce: from n/a through 2.2.0...