19135 matches found
WordPress Cancel Order & Request Woocommerce plugin < 1.3.4.34 - Unauthenticated Order Content Disclosure via Reorder AJAX Actions vulnerability
Unauthenticated Order Content Disclosure via Reorder AJAX Actions vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Cancel order request WooCommerce versions 1.3.4.34...
CVE-2026-73363
Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce 2.0.8 versions...
CVE-2026-32552
Subscriber SQL Injection in YITH WooCommerce Membership Premium = 2.33.0 versions...
CVE-2026-73389
CVE-2026-73389 is an unauthenticated PHP Object Injection vulnerability in the Kalles Addons WordPress plugin, affecting versions 1.0.6 and earlier . The flaw allows a remote, unauthenticated attacker to achieve full compromise of confidentiality, integrity, and availability, reflected in a CVSS ...
CVE-2026-73363 WordPress Taxi Booking Manager for WooCommerce plugin < 2.0.8 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce 2.0.8 versions...
CVE-2026-73363
CVE-2026-73363 is an unauthenticated Broken Access Control vulnerability in the WordPress plugin Taxi Booking Manager for WooCommerce (plugin slug: ecab-taxi-booking-manager ), affecting versions prior to 2.0.8 . The flaw allows a low-privileged user to perform unauthorized actions, resulting in ...
CVE-2026-73364
WordPress Flexible Subscriptions plugin (versions ≤ 1.8.1) is vulnerable to PHP Object Injection, allowing unauthenticated remote attackers to execute arbitrary code and achieve full system compromise (CVSS 9.8 Critical). Patchstack reference: https://patchstack.com/database/wordpress/plugin/flex...
EUVD-2026-62383
Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce 2.0.8 versions...
CVE-2026-32552
A SQL Injection vulnerability exists in the YITH WooCommerce Membership Premium WordPress plugin, affecting versions 2.33.0 and earlier . The flaw is in the Subscriber functionality and was discovered by dutafi . The CVSS 3.1 score is 8.5 (HIGH) , with a network attack vector, low complexity, and...
EUVD-2026-62372
Subscriber SQL Injection in YITH WooCommerce Membership Premium = 2.33.0 versions...
CVE-2026-32552 WordPress YITH WooCommerce Membership Premium plugin <= 2.33.0 - SQL Injection vulnerability
Subscriber SQL Injection in YITH WooCommerce Membership Premium = 2.33.0 versions...
WordPress Paymob for WooCommerce plugin <= 4.1.10 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Paymob for WooCommerce versions = 4.1.10...
CVE-2026-19709
The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan detail...
CVE-2026-19709
The Membership For WooCommerce WordPress plugin before 3.1.2 contains an unauthenticated data disclosure vulnerability in its REST API authentication logic. The plugin fails to verify that an API consumer secret has actually been generated before comparing it against the value supplied in a reque...
EUVD-2026-62291
The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan detail...
CVE-2026-19709 Membership For WooCommerce < 3.1.2 - Unauthenticated Member Data Disclosure via REST Consumer Secret Bypass
The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan detail...
CVE-2026-74009
Unauthenticated Insecure Direct Object References IDOR in Razorpay for WooCommerce = 4.8.7 versions...
CVE-2026-73398
Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 versions...