WordPress WooCommerce Designer Pro plugin <= 1.9.33 - Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin WooCommerce Designer Pro versions = 1.9.33...

WordPress Faktur Pro for WooCommerce plugin <= 3.2.2 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by HieuPenguinnn in WordPress Plugin Faktur Pro for WooCommerce versions = 3.2.2...

WordPress ECPay Ecommerce for WooCommerce plugin <= 1.1.2606090 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Tran The Long in WordPress Plugin ECPay Ecommerce for WooCommerce versions = 1.1.2606090...

WordPress WooCommerce Lottery plugin <= 2.2.9 - SQL Injection vulnerability

SQL Injection vulnerability discovered by dutafi in WordPress Plugin WooCommerce Lottery versions = 2.2.9...

WordPress Deposits and Partial Payments for WooCommerce plugin <= 4.0.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by sungbyeongchan in WordPress Plugin Deposits and Partial Payments for WooCommerce versions = 4.0.1...

CVE-2026-104118

The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitrary orders...

CVE-2026-104118 Razorpay for WooCommerce < 4.8.8 - Unauthenticated Order Shipping Modification via IDOR

The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitrary orders...

CVE-2026-104118

The Razorpay for WooCommerce WordPress plugin, in versions prior to 4.8.8 , is vulnerable to an authorization bypass. The flaw exists because the plugin fails to perform ownership or authorization checks on a specific REST API route utilized during the checkout process. This oversight allows unau...

EUVD-2026-92072

The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitrary orders...

CVE-2026-104118 Razorpay for WooCommerce < 4.8.8 - Unauthenticated Order Shipping Modification via IDOR

The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitrary orders...

CVE-2026-104118: Authorization Bypass Through User-Controlled Key

The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitrary orders...

PT-2026-104605

Name of the Vulnerable Software and Affected Versions Razorpay for WooCommerce WordPress plugin versions prior to 4.8.8 Description An issue exists where the plugin fails to perform ownership or authorization checks on a REST API route used during the checkout process. This allows unauthenticated...

WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 3.4.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by neurotx in WordPress Plugin ShopBuilder – Elementor WooCommerce Builder Addons versions = 3.4.1...

WordPress Product Feed PRO for WooCommerce plugin <= 13.5.7 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Product Feed PRO for WooCommerce versions = 13.5.7...

WordPress Pay with Vipps for WooCommerce plugin <= 6.2.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Pay with Vipps for WooCommerce versions = 6.2.0...

WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 - Bypass Vulnerability vulnerability

Bypass Vulnerability vulnerability discovered by dcs in WordPress Plugin BuildKit – Product Builder for WooCommerce – Custom PC Builder versions = 1.0.28...

WordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Oly Hossen in WordPress Plugin Photo Reviews for WooCommerce versions = 1.2.30...

WordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Missing Authorization to Unauthenticated Arbitrary Post Deletion vulnerability

Missing Authorization to Unauthenticated Arbitrary Post Deletion vulnerability discovered by Ivaylo in WordPress Plugin Photo Reviews for WooCommerce versions = 1.2.30...

WordPress WPC Product Options for WooCommerce plugin <= 4.0.5 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Sebastian Albrecht mySebbe in WordPress Plugin WPC Product Options for WooCommerce versions = 4.0.5...

WordPress WPC Smart Quick View for WooCommerce plugin <= 4.4.0 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Kuba in WordPress Plugin WPC Smart Quick View for WooCommerce versions = 4.4.0...