CVE-2024-8289

CVE-2024-8289 CVE-2024-8289 https://vulners.com/cve/CVE-2024-8289, Vendor wcmp Product MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution...

CVE-2025-11391

Inyección SQL Ciega No Autenticada en PPOM para WooCommerce = 33.0.15 Este repositorio contiene una Prueba de Concepto PoC para una vulnerabilidad de inyección SQL ciega basada en tiempo no autenticada en el plugin de WordPress "PPOM for WooCommerce", que afecta a las versiones hasta la 33.0.15...

woo

Woocommerce 3.3 a 5.5 - Inyección SQL no autenticada https://wpscan.com/vulnerability/1212fec8-1fde-41e5-af70-abdd7ffe5379 Explota el SQLI de Woocommerce y obtiene el hash de usuario y contraseña Comandos root@kitploit: usage: woo.py -h -u URL -f FILE -p PROXY -i WID optional arguments: -h, --hel...

CVE-2025-4403

CVE-2025-4403 Exploit Detalles Publicado : May 8, 2025 Actualizado : May 9, 2025 Gravedad : Alta CVSS Score: 9.8 CWE : CWE-434 - Subida sin restricciones de archivos con tipo peligroso Versiones afectadas : Todas las versiones desde n/a hasta 1.1.6 Vector CVSS Versión CVSS : 9.8 Cadena del vector...

CVE-2021-32789

CVE-2021-32789 Inyección SQL ciega autenticada. Versiones = 2.5.0 del plugin woocommerce de Wordpress Instalación root@kitploit: git clone https://github.com/DonVorrin/CVE-2021-32789.git cd CVE-2021-32789 sudo pip install -r requirements.txt Explotación root@kitploit: python3 exploit.py Enter URL...

CVE-2024-54262

CVE-2024-54262 WooCommerce 导入导出插件 = 1.5 - 认证用户（订阅者及以上）任意文件上传 描述 WordPress 的 WooCommerce 导入导出插件在所有版本（包括 1.5）中存在任意文件上传漏洞，原因是缺少文件类型验证。这使得经过身份验证的攻击者（拥有订阅者及以上级别访问权限）能够在受影响站点的服务器上上传任意文件，从而可能导致远程代码执行。 详情 类型 : plugin 标识 : import-export-for-woocommerce 受影响版本 : 1.5 CVSS 分数 : 9.9 CVSS 评级 : Critical CVSS 向量 ...

CVE-2023-2986

CVE-2023-2986 概念验证 POC Python 版本，作者：Alucard0x1 'Abandoned Cart Lite for WooCommerce' WordPress 插件中漏洞 CVE-2023-2986 的概念验证 Python 版本 鸣谢 https://github.com/Ayantaker/CVE-2023-2986...

CVE-2023-28121

CVE-2023-28121 WooCommerce Payments: 未授权管理员访问漏洞利用 这个不会先发布...这是肯定的.. PoC现已发布。 它仅用于教育/研究目的！使用风险自负！...

CVE-2026-54807

CVE-2026-54807 CVE-2026-54807 Escalada de Privilegios en WooCommerce ║ ║ Asignación de Rol de Administrador no Autenticada a través del Formulario de Registro CANAL DE HERRAMIENTAS Y EXPLOITS PRIV8: https://t.me/+zuUQbKSrHgwyZmI0...

CVE-2026-9858

The Partial Shipment for Woocommerce plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.4 via the wxpordershipment, wxporderitemshipment, and wxpordersetshipped AJAX actions. This is due to the AJAX handlers in woocommerce-partial-shipment.php register...

CVE-2026-9766

The Empik for Woocommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVE-2026-9858

Partial Shipment for Woocommerce (WordPress plugin, versions ≤ 3.4) is vulnerable to Missing Authorization via the wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shipped AJAX actions. The root cause is that the AJAX handlers in woocommerce-partial-shipment.php (lines 228, 263, 291...

EUVD-2026-83570

The Partial Shipment for Woocommerce plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.4 via the wxpordershipment, wxporderitemshipment, and wxpordersetshipped AJAX actions. This is due to the AJAX handlers in woocommerce-partial-shipment.php register...

CVE-2026-9766 Empik for Woocommerce <= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Product Meta Update via empik_csv_process_emp_log_classes AJAX Action

The Empik for Woocommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

EUVD-2026-83566

The Empik for Woocommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVE-2026-9766

The Empik for Woocommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 1.5.1 . The root cause is improper verification of user permissions in the empik_csv_process_emp_log_classes AJAX action, allowing any authenticated user with subscriber-level ...

CVE-2026-75959

The GoPay for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'logtablefilter' parameter in all versions up to, and including, 1.0.36 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This make...

CVE-2026-11899

The PDF Builder for WooCommerce. Create invoices,packing slips and more plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.0.11. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible...

CVE-2026-12402

The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fb-config' Setting in all versions up to, and including, 2.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

EUVD-2026-83552

The GoPay for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'logtablefilter' parameter in all versions up to, and including, 1.0.36 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This make...