CVE-2026-97268: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Premmerce Wishlist for WooCommerce = 1.1.13 versions...

PT-2026-103889

Unauthenticated Cross Site Scripting XSS in Premmerce Wishlist for WooCommerce = 1.1.13 versions...

CVE-2026-100517: Authorization Bypass Through User-Controlled Key

Unauthenticated Insecure Direct Object References IDOR in Photo Reviews for WooCommerce = 1.2.30 versions...

PT-2026-103846

Missing Authorization vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a through 1.0.9...

PT-2026-103843

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Blind SQL Injection.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC...

PT-2026-103875

Unauthenticated Insecure Direct Object References IDOR in Photo Reviews for WooCommerce = 1.2.30 versions...

PT-2026-103670

Name of the Vulnerable Software and Affected Versions Advanced Woo Labels – Product Labels & Badges for WooCommerce versions prior to 2.52 Description An improperly secure capability check in the save meta boxes function allows authenticated attackers with Contributor-level access or higher to...

PT-2026-103891

Name of the Vulnerable Software and Affected Versions Premmerce Wishlist for WooCommerce versions prior to 1.1.14 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior...

PT-2026-103884

Editor PHP Object Injection in Hide Shipping Method For WooCommerce = 1.5.4 versions...

CVE-2026-12241: Improper Neutralization of Input During Web Page Generation

The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to an improperly secure capability check on the 'savemetaboxes' function in all versions up to, and including, 2.51. This makes it possible for authenticat...

CVE-2026-102379: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Blind SQL Injection.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC...

CVE-2026-97273: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Premmerce Wishlist for WooCommerce = 1.1.13 versions...

CVE-2026-94390: Deserialization of Untrusted Data

Editor PHP Object Injection in Hide Shipping Method For WooCommerce = 1.5.4 versions...

CVE-2026-92244: Improper Neutralization of Input During Web Page Generation

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields in all versions up to, and including, 5.16.1 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2026-102390: Missing Authorization

Missing Authorization vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a through 1.0.9...

CVE-2026-102392

Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields = 3.3.8 versions...

CVE-2026-102392 WordPress Extra Product Options For WooCommerce | Custom Product Addons and Fields plugin <= 3.3.8 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields = 3.3.8 versions...

EUVD-2026-90225

Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields = 3.3.8 versions...

CVE-2026-102392

The Extra Product Options For WooCommerce | Custom Product Addons and Fields plugin for WordPress is vulnerable to a PHP Object Injection vulnerability in versions

CVE-2026-102392 WordPress Extra Product Options For WooCommerce | Custom Product Addons and Fields plugin <= 3.3.8 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields = 3.3.8 versions...