CVE-2026-15670

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-15670 SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied parameter and lack of...

EUVD-2026-49709

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 3.9.7 via the billingphone parameter. This is due to the processRegistration...

CVE-2026-66475

Shop manager Cross Site Scripting XSS in Checkout Field Editor for WooCommerce Checkout Manager = 3.0.5 versions...

CVE-2026-65557

Shop manager Cross Site Scripting XSS in Abandoned Cart Lite for WooCommerce = 6.8.0 versions...

CVE-2026-65434

Subscriber Sensitive Data Exposure in ЮKassa для WooCommerce = 2.16.1 versions...

CVE-2026-59556

Unauthenticated Cross Site Scripting XSS in Dynamic Pricing With Discount Rules for WooCommerce = 4.5.11 versions...

CVE-2026-59537

Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce = 2.10.22 versions...

CVE-2026-59530

Unauthenticated Broken Access Control in Stripe For WooCommerce = 4.0.7 versions...

CVE-2026-66475

Shop manager Cross Site Scripting XSS in Checkout Field Editor for WooCommerce - Checkout Manager = 3.0.5 versions...

CVE-2026-66475

CVE-2026-66475 affects the WordPress plugin “Checkout Field Editor for WooCommerce – Checkout Manager” up to version ≤ 3.0.5. The connected documents describe a Cross Site Scripting (XSS) vulnerability impacting shop manager workflows, but do not provide technical details about the root cause, af...

CVE-2026-66475 WordPress Checkout Field Editor for WooCommerce &#8211; Checkout Manager plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability

Shop manager Cross Site Scripting XSS in Checkout Field Editor for WooCommerce Checkout Manager = 3.0.5 versions...

EUVD-2026-49250

Shop manager Cross Site Scripting XSS in Checkout Field Editor for WooCommerce Checkout Manager = 3.0.5 versions...

EUVD-2026-49232

Shop manager Cross Site Scripting XSS in Abandoned Cart Lite for WooCommerce = 6.8.0 versions...

CVE-2026-65557

CVE-2026-65557 concerns the WordPress plugin Abandoned Cart Lite for WooCommerce (versions &lt;= 6.8.0), where a Cross Site Scripting (XSS) flaw affects the shop-manager context. The connected records confirm the affected product (WordPress WooCommerce plugin), the vulnerability type (XSS), and t...

CVE-2026-65557

Shop manager Cross Site Scripting XSS in Abandoned Cart Lite for WooCommerce = 6.8.0 versions...

CVE-2026-65434

The CVE-2026-65434 entry concerns the WordPress plugin ЮKassa для WooCommerce (YuKassa for WooCommerce)

CVE-2026-65434

Subscriber Sensitive Data Exposure in ЮKassa для WooCommerce = 2.16.1 versions...

CVE-2026-65434 WordPress ЮKassa для WooCommerce plugin <= 2.16.1 - Sensitive Data Exposure vulnerability

Subscriber Sensitive Data Exposure in ЮKassa для WooCommerce = 2.16.1 versions...

EUVD-2026-49229

Subscriber Sensitive Data Exposure in ЮKassa для WooCommerce = 2.16.1 versions...