CVE-2023-28121

CVE-2023-28121 usage: CVE-2023-28121.py -h -v RHOST RPORT WooCommerce Payments WordPress plugin = 5.6.1 CVE-2023-28121 PoC. Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-28121 positional arguments: RHOST remote host RPORT remote port optional arguments: -h, --help show this help message an...

Mass-CVE-2023-28121

CVE-2023-28121 WooCommerce Payments 5.6.2 - Unauthenticated Privilege Escalation Mass Add Admin User Introduction This script using Python3 and use threading for better process speed. The script has ben updated to 2 version. V1 is the old version and V2 the newer version with random username, ema...

CVE-2026-3891

Pix for WooCommerce = 1.5.0 - Unauthenticated Arbitrary File Upload CVE-2026-3891 PoC 📜 Description CVE-2026-3891 is an unauthenticated arbitrary file upload vulnerability in the Pix for WooCommerce WordPress plugin. The plugin exposes an AJAX endpoint lknpixforwoocommercec6savesettings that...

CVE-2026-3891

CVE-2026-3891 Pix for WooCommerce If protocol is missing → scri...

CVE-2024-50510

CVE-2024-50510 AR For Woocommerce = 6.2 - Unauthenticated Arbitrary File Upload Description The AR for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 6.2. This makes it possible for unauthenticated...

CVE-2022-4047

CVE-2022-4047 Return Refund and Exchange For WooCommerce 4.0.9 - Unauthenticated Arbitrary File Upload Usage @@@@@@@ @@@ @@@ @@@@@@@@ @@@@@@ @@@@@@@@ @@@@@@ @@@@@@ @@@ @@@@@@@@ @@@ @@@@@@@@ @@@@@@@@ @@@ @@@ @@@@@@@@ @@@@@@@@ @@@@@@@@@@ @@@@@@@@ @@@@@@@@ @@@@ @@@@@@@@@@ @@@@ @@@@@@@@ !@@ @@! @@@ @...

CVE-2025-1661

CVE-2025-1661 - Unauthenticated Local File Inclusion LFI in HUSKY – Products Filter Professional for WooCommerce Description The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion LFI in all versions up to and including 1.3.6.5 via the...

CVE-2026-3891-Pix-for-WooCommerce-Plugin-Exploit

CVE-2026-3891-Pix-for-WooCommerce-Plugin-Exploit 🛡️ Description CVE-2026-3891 is a critical Unauthenticated Arbitrary File Upload vulnerability found in the Pix for WooCommerce WordPress plugin in versions up to and including 1.5.0. The vulnerability exists in the lknpixforwoocommercec6savesetting...

CVE-2026-14281-check

CVE-2026-14281 Checker A lightweight, Windows-friendly Python security checker for identifying WordPress installations that may be affected by CVE-2026-14281. The tool performs passive, non-destructive checks. It does not exploit the vulnerability, create accounts, modify privileges, or alter the...

CVE-2026-27540

🌐 Language / Dil 📌 Özet WooCommerce Wholesale Lead Capture WWLC — Kimlik doğrulamasız dosya yükleme → RCE | ---|--- Ürün| WooCommerce Wholesale Lead Capture — wwlc eklentisi Sürüm| ≤ 2.0.3.1 Fixed| 2.0.3.2+ — upload handler korumalı Auth| Unauthenticated Vektör|...

CVE-2026-55826

The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, the WooCommerce purchase event tracking mechanism allows an unauthenticated attacker to trigger the rendering of another customer's full order data — includin...

CVE-2026-18143

CVE-2026-18143 — Request a Quote for WooCommerce Addify Arbitrary File Upload Python 3 PoC for CVE-2026-18143 in Request a Quote for WooCommerce woocommerce-request-a-quote, Addify / WooCommerce.com. Description PoCbit / GitHub CVE-2026-18143 — Request a Quote for WooCommerce ≤ 2.9.2 allows...

CVE-2026-55826 Customer Order Data Exposed via Unauthenticated gtm_server_side_order_id Cookie Manipulation in GTM Server Side WordPress Plugin

The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, the WooCommerce purchase event tracking mechanism allows an unauthenticated attacker to trigger the rendering of another customer's full order data — includin...

CVE-2026-55826

The GTM Server Side plugin by stape.io for WordPress is vulnerable to an information disclosure flaw in versions 2.0.0 through 2.1.47 . An unauthenticated attacker can manipulate the gtm_server_side_order_id cookie to trigger the rendering of another customer's full order data, including personal...

EUVD-2026-108976

The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, the WooCommerce purchase event tracking mechanism allows an unauthenticated attacker to trigger the rendering of another customer's full order data — includin...

CVE-2025-4336

eMagicOne Store Manager for WooCommerce 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo...

CVE-2026-89055

CVE-2026-89055 — Customer Reviews for WooCommerce CusRev Authorization Bypass Python 3 PoC for CVE-2026-89055 in Customer Reviews for WooCommerce customer-reviews-woocommerce / Ivole CusRev. Description PoCbit / GitHub CVE-2026-89055 — Customer Reviews for WooCommerce CusRev ≤ 5.120.0 is vulnerab...

CVE-2024-13513

Oliver POS – A WooCommerce Point of Sale POS = 2.4.2.3 - Sensitive Information Exposure to Privilege Escalation Account TakeOver CVE-2024-13513 The Oliver POS – A WooCommerce Point of Sale POS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includin...

CVE-2026-93528

📌 CVE-2026-93528: Unauthenticated Order Data Disclosure in NP Quote Request for WooCommerce • Vulnerability Type: Sensitive Data Disclosure CWE-200 • Affected Software: woo-rfq-for-woocommerce 2.4.16 • Original Researcher: Murad Islamzada • Vendor: Neah Plugins Cyrus 1. Overview & Root Cause The...

CVE-2023-28121

CVE-2023-28121 WooCommerce Payments: Unauthorized Admin Access Exploit Won't be publishing this one first... thats for sure.. PoC is now published. It was created for educational/research purposes only! Use it at your own risk!...