PT-2026-104080

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'lang' parameter in all versions up to, and including, 7.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

PT-2026-104154

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 5.122.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-97663: Improper Neutralization of Input During Web Page Generation

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 5.122.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

PT-2026-104084

Name of the Vulnerable Software and Affected Versions Tabs Responsive WordPress plugin versions prior to 2.6 Description The plugin fails to sanitize the content of WooCommerce product tabs before storing and rendering it. This allows a user with shop manager privileges to inject malicious...

CVE-2026-91020: External Control of Assumed-Immutable Web Parameter

The WebToffee Gift Cards for WooCommerce WordPress plugin before 1.3.1 does not validate a user-supplied gift card amount server-side before using it as the cart-item price and store-credit coupon value, allowing unauthenticated users to submit an arbitrary or negative amount, bypassing the...

PT-2026-104090

The Motors WordPress plugin before 1.4.124 does not properly verify that a user is authorised to modify a listing before processing one of its listing management actions, allowing authenticated attackers with subscriber-level access and above to set metadata on posts they do not own, including...

CVE-2026-84925: Improper Neutralization of Input During Web Page Generation

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'lang' parameter in all versions up to, and including, 7.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-13718: Improper Neutralization of Input During Web Page Generation

The Tabs Responsive WordPress plugin through 2.5 does not sanitize the content of WooCommerce product tabs before storing and rendering it, allowing a shop manager to store JavaScript that executes when any user, including an administrator, views the product page...

CVE-2026-12951: Improper Neutralization of Special Elements used in an SQL Command

The Dc Woocommerce Multi Vendor plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the /multivendorx/v1/compliance/report-abuse REST endpoint in versions up to and including 5.0.18. This is due to insufficient escaping on the user supplied parameter and lack of...

PT-2026-104126

Name of the Vulnerable Software and Affected Versions Dc Woocommerce Multi Vendor versions prior to 5.0.19 Description An issue exists where authenticated attackers with vendor-level access or higher specifically those with the edit stores capability can perform SQL Injection. This occurs because...

PT-2026-104113

The WebToffee Gift Cards for WooCommerce WordPress plugin before 1.3.1 does not validate a user-supplied gift card amount server-side before using it as the cart-item price and store-credit coupon value, allowing unauthenticated users to submit an arbitrary or negative amount, bypassing the...

CVE-2026-91023: Missing Authorization

The Motors WordPress plugin before 1.4.124 does not properly verify that a user is authorised to modify a listing before processing one of its listing management actions, allowing authenticated attackers with subscriber-level access and above to set metadata on posts they do not own, including...

CVE-2026-97273

Unauthenticated Cross Site Scripting XSS in Premmerce Wishlist for WooCommerce = 1.1.13 versions...

CVE-2026-97268

Unauthenticated Cross Site Scripting XSS in Premmerce Wishlist for WooCommerce = 1.1.13 versions...

CVE-2026-94390

Editor PHP Object Injection in Hide Shipping Method For WooCommerce = 1.5.4 versions...

CVE-2026-100517

Unauthenticated Insecure Direct Object References IDOR in Photo Reviews for WooCommerce = 1.2.30 versions...

CVE-2026-100517 WordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Photo Reviews for WooCommerce = 1.2.30 versions...

EUVD-2026-90843

Unauthenticated Insecure Direct Object References IDOR in Photo Reviews for WooCommerce = 1.2.30 versions...

CVE-2026-100517

The Photo Reviews for WooCommerce WordPress plugin (versions

CVE-2026-100517 WordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Photo Reviews for WooCommerce = 1.2.30 versions...