WordPress WooCommerce Orders & Customers Exporter <= 5.0 - Sensitive Data Exposure Vulnerability

Sensitive Data Exposure Vulnerability discovered by 0xd4rk5id3 Patchstack Alliance in WordPress Plugin WooCommerce Orders & Customers Exporter versions = 5.0...

PT-2025-23296 · Unknown · Vanquish Woocommerce Orders & Customers Exporter

Name of the Vulnerable Software and Affected Versions: Vanquish WooCommerce Orders & Customers Exporter versions n/a through 5.0 Description: The issue allows the retrieval of embedded sensitive data due to the insertion of sensitive information into sent data. Recommendations: For versions n/a...

WordPress plugin WooCommerce Orders & Customers Exporter 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exist...

Over 100,000 WordPress Sites at Risk from Critical CVSS 10.0 Vulnerability in Wishlist Plugin

Cybersecurity researchers have disclosed a critical unpatched security flaw impacting TI WooCommerce Wishlist plugin for WordPress that could be exploited by unauthenticated attackers to upload arbitrary files. TI WooCommerce Wishlist, which has over 100,000 active installations, is a tool to all...

PT-2025-23026

Warning: High severity vulnerabilities in @Citrix XenServer VM Tools for Windows CVE-2025-27462, CVE-2025-27463, CVE-2025-27464 impact Windows VMs on XenServer 8.4 & Citrix Hypervisor 8.2 CU1 LTSR, risking sandbox escapes. Act now! Patch https://t.co/SF4q8mMyxr...

PT-2025-23025

Warning: High severity vulnerabilities in @Citrix XenServer VM Tools for Windows CVE-2025-27462, CVE-2025-27463, CVE-2025-27464 impact Windows VMs on XenServer 8.4 & Citrix Hypervisor 8.2 CU1 LTSR, risking sandbox escapes. Act now! Patch https://t.co/SF4q8mMyxr...

Exploit for Cross-Site Request Forgery (CSRF) in Tychesoftwares Order_Delivery_Date_Pro_For_Woocommerce

This is a PoC exploit for CVE-2025-2907, an unauthenticated arbi...

CVE-2025-47461

Authentication Bypass Using an Alternate Path or Channel vulnerability in mediaticus Subaccounts for WooCommerce subaccounts-for-woocommerce allows Authentication Abuse.This issue affects Subaccounts for WooCommerce: from n/a through = 1.6.6...

CVE-2025-47641

Unrestricted Upload of File with Dangerous Type vulnerability in printcart Printcart Web to Print Product Designer for WooCommerce printcart-integration allows Upload a Web Shell to a Web Server.This issue affects Printcart Web to Print Product Designer for WooCommerce: from n/a through = 2.3.9...

CVE-2025-47687

Unrestricted Upload of File with Dangerous Type vulnerability in StoreKeeper B.V. StoreKeeper for WooCommerce storekeeper-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects StoreKeeper for WooCommerce: from n/a through = 14.4.4...

CVE-2025-47640

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in printcart Printcart Web to Print Product Designer for WooCommerce printcart-integration allows SQL Injection.This issue affects Printcart Web to Print Product Designer for WooCommerce: from n/a...

CVE-2025-47532

Deserialization of Untrusted Data vulnerability in CoinPayments CoinPayments.net Payment Gateway for WooCommerce coinpayments-payment-gateway-for-woocommerce allows Object Injection.This issue affects CoinPayments.net Payment Gateway for WooCommerce: from n/a through = 1.0.17...

CVE-2025-31056

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Techspawn WhatsCart - Whatsapp Abandoned Cart Recovery, Order Notifications, Chat Box, OTP for WooCommerce WhatsCart-for-WooCommerce allows SQL Injection.This issue affects WhatsCart - Whatsapp...

CVE-2025-31397

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in smartcms Bus Ticket Booking with Seat Reservation for WooCommerce scw-bus-seat-reservation allows SQL Injection.This issue affects Bus Ticket Booking with Seat Reservation for WooCommerce: from n/a...

CVE-2025-5058

The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the setimage function in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the...

CVE-2025-4603

The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletefile function in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to delete arbitrary files...

CVE-2025-4336

The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the setfile function in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the...

CVE-2025-5062

The WooCommerce plugin for WordPress is vulnerable to PostMessage-Based Cross-Site Scripting via the 'customize-store' page in all versions up to, and including, 9.4.2 due to insufficient input sanitization and output escaping on PostMessage data. This makes it possible for unauthenticated...

CVE-2025-4336

The CVE describes an unauthenticated arbitrary file upload in the eMagicOne Store Manager for WooCommerce WordPress plugin (versions

CVE-2025-4336 eMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Upload via set_file()

The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the setfile function in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the...