24390 matches found
PT-2026-103884
Editor PHP Object Injection in Hide Shipping Method For WooCommerce = 1.5.4 versions...
CVE-2026-12241: Improper Neutralization of Input During Web Page Generation
The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to an improperly secure capability check on the 'savemetaboxes' function in all versions up to, and including, 2.51. This makes it possible for authenticat...
CVE-2026-102379: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Blind SQL Injection.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC...
CVE-2026-97273: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Premmerce Wishlist for WooCommerce = 1.1.13 versions...
CVE-2026-94390: Deserialization of Untrusted Data
Editor PHP Object Injection in Hide Shipping Method For WooCommerce = 1.5.4 versions...
CVE-2026-92244: Improper Neutralization of Input During Web Page Generation
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields in all versions up to, and including, 5.16.1 due to insufficient input sanitization and output escaping. This makes it possible fo...
CVE-2026-102390: Missing Authorization
Missing Authorization vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a through 1.0.9...
CVE-2026-102392
Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields = 3.3.8 versions...
CVE-2026-102392
The Extra Product Options For WooCommerce | Custom Product Addons and Fields plugin for WordPress is vulnerable to a PHP Object Injection vulnerability in versions
CVE-2026-102392 WordPress Extra Product Options For WooCommerce | Custom Product Addons and Fields plugin <= 3.3.8 - PHP Object Injection vulnerability
Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields = 3.3.8 versions...
EUVD-2026-90225
Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields = 3.3.8 versions...
CVE-2026-102392 WordPress Extra Product Options For WooCommerce | Custom Product Addons and Fields plugin <= 3.3.8 - PHP Object Injection vulnerability
Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields = 3.3.8 versions...
CVE-2026-97259
Authorization Bypass Through User-Controlled Key vulnerability in WP Hosting AS Pay with Vipps for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.4...
EUVD-2026-89960
Authorization Bypass Through User-Controlled Key vulnerability in WP Hosting AS Pay with Vipps for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.4...
CVE-2026-97259
The Pay with Vipps for WooCommerce plugin (versions up to and including 6.2.4 ) is vulnerable to an Insecure Direct Object References (IDOR) flaw. This Authorization Bypass occurs because of incorrectly configured access control security levels, allowing attackers to exploit a User-Controlled Key...
CVE-2026-97259 WordPress Pay with Vipps for WooCommerce plugin <= 6.2.4 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in WP Hosting AS Pay with Vipps for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.4...
WordPress Extra Product Options For WooCommerce | Custom Product Addons and Fields plugin <= 3.3.8 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Extra Product Options For WooCommerce | Custom Product Addons and Fields versions = 3.3.8...
CVE-2026-97299
Unauthenticated Cross Site Request Forgery CSRF in Razorpay Payment Links for WooCommerce = 2.1.5 versions...