Lucene search
+L

3634 matches found

EUVD
EUVD
added 1 hour ago2 views

EUVD-2026-54205

The WPC Name Your Price for WooCommerce WordPress plugin before 2.2.5 does not enforce its server-side price allowlist for products configured in "Select" price mode, allowing an unauthenticated visitor to add such a product to the cart at an arbitrary value below the merchant-defined allowed...

7.5CVSS5.6AI score
SaveExploits0References2
CVE
CVE
added yesterday13 views

CVE-2026-66692

CVE-2026-66692 affects the WordPress Colissimo Officiel: Méthodes de livraison pour WooCommerce plugin (≤ 2.10.0). The issue is an insecure direct object reference (IDOR) in delivery methods. According to the available sources, the vulnerability is rated CVSS 3.1 base score 4.3 (Network, Privileg...

4.3CVSS5.4AI score
SaveExploits0References1
CVE
CVE
added yesterday9 views

CVE-2026-28180

The CVE describes an unauthenticated Insecure Direct Object References (IDOR) vulnerability in the Mercado Pago payments for WooCommerce plugin for WordPress, affecting versions

5.3CVSS5.4AI score
SaveExploits0References1
NVD
NVD
added yesterday7 views

CVE-2026-16054

The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.8 does not prevent unauthenticated users from obtaining a valid nonce that is the only control gating its file-deletion routine, allowing anonymous attackers to delete files staged in its upload directory and...

9.1CVSS0.00145EPSS
SaveExploits0References1
NVD
NVD
added yesterday7 views

CVE-2026-14314

The PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 does not verify that a requested attachment belongs to the order referenced by its access token, allowing unauthenticated attackers to forge a token and disclose image attachments, including other customers' uploaded payment...

5.3CVSS0.00146EPSS
SaveExploits0References1
NVD
NVD
added yesterday7 views

CVE-2026-14313

PeproDev WooCommerce Receipt Uploader PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 slug: pepro-bacs-receipt-upload-for-woocommerce, all versions up to and including 2.8.0 latest on wordpress.org; no fixed version available at the time of writing, is vulnerable to...

5.3CVSS0.00102EPSS
SaveExploits0References1
Nuclei
Nuclei
added yesterday26 views

WCAPF WooCommerce Ajax Product Filter - SQL Injection

WCAPF WooCommerce Ajax Product Filter = 4.2.3 contains a time-based SQL injection caused by insufficient escaping of the 'post-author' parameter, letting unauthenticated attackers extract sensitive database information remotely. id: CVE-2026-3396 info: name: WCAPF WooCommerce Ajax Product Filter ...

7.5CVSS5.7AI score0.01473EPSS
SaveExploits0References2
Nuclei
Nuclei
added yesterday20 views

Hippoo Mobile App for WooCommerce <= 1.9.4 - Authentication Bypass to Admin Account Takeover

Hippoo Mobile App for WooCommerce WordPress plugin = 1.9.4 contains an authentication bypass caused by logic conflation in user permission checks, letting unauthenticated attackers take over administrator accounts via REST API password reset. id: CVE-2026-10580 info: name: Hippoo Mobile App for...

9.8CVSS5.4AI score0.02948EPSS
SaveExploits1References2
Nuclei
Nuclei
added yesterday47 views

WordPress OrderConvo < 14 - Path Traversal

WooCommerce OrderConvo WordPress plugin \u003C 14 contains a path traversal vulnerability caused by improper validation of file download paths, letting unauthenticated attackers read or download arbitrary files remotely id: CVE-2025-10162 info: name: WordPress OrderConvo 14 - Path Traversal autho...

7.5CVSS5.6AI score0.03632EPSS
SaveExploits4References3
Nuclei
Nuclei
added yesterday39 views

Custom Product Tabs for WooCommerce < 1.7.8 - Unauthenticated Toggle Content Setting Update

YIKES Inc. Custom Product Tabs for WooCommerce plugin \u003C= 1.7.7 contains a broken access control caused by improper permission checks in &yikes-the-content-toggle option update, letting attackers modify content without authorization. id: CVE-2022-28666 info: name: Custom Product Tabs for...

5.3CVSS5.9AI score0.0137EPSS
SaveExploits1References1
CVE
CVE
added yesterday11 views

CVE-2026-16054

CVE-2026-16054 affects the Drag and Drop Multiple File Upload for WooCommerce WordPress plugin prior to 1.1.8. The issue permits unauthenticated users to obtain a valid nonce that gates the plugin’s file-deletion routine, enabling anonymous attackers to delete files staged in the upload directory...

9.1CVSS5.5AI score0.00145EPSS
SaveExploits0References1
Cvelist
Cvelist
added yesterday9 views

CVE-2026-16054 Drag and Drop Multiple File Upload for WooCommerce < 1.1.8 - Unauthenticated File Deletion via Nonce Oracle

The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.8 does not prevent unauthenticated users from obtaining a valid nonce that is the only control gating its file-deletion routine, allowing anonymous attackers to delete files staged in its upload directory and...

0.00145EPSS
SaveExploits0References1
EUVD
EUVD
added yesterday5 views

EUVD-2026-53722

The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.8 does not prevent unauthenticated users from obtaining a valid nonce that is the only control gating its file-deletion routine, allowing anonymous attackers to delete files staged in its upload directory and...

9.1CVSS5.5AI score0.00145EPSS
SaveExploits0References1
CVE
CVE
added yesterday11 views

CVE-2026-14314

The CVE concerns the PeproDev WooCommerce Receipt Uploader WordPress plugin (≤ v2.8.0). The root cause is a failure to verify that a requested attachment belongs to the order referenced by its access token, enabling an unauthenticated attacker to forge a token and disclose image attachments, incl...

5.3CVSS5.5AI score0.00146EPSS
SaveExploits0References1
Cvelist
Cvelist
added yesterday8 views

CVE-2026-14314 PeproDev WooCommerce Receipt Uploader <= 2.8.0 - Unauthenticated Image Attachment Disclosure via IDOR

The PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 does not verify that a requested attachment belongs to the order referenced by its access token, allowing unauthenticated attackers to forge a token and disclose image attachments, including other customers' uploaded payment...

0.00146EPSS
SaveExploits0References1
Patchstack
Patchstack
added 2 days ago7 views

WordPress Dynamic Pricing With Discount Rules for WooCommerce plugin < 5.0.0 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by João Ramos Maciel in WordPress Plugin Dynamic Pricing With Discount Rules for WooCommerce versions 5.0.0...

7.1CVSS5.4AI score0.00164EPSS
SaveExploits0References1Affected Software1
EUVD
EUVD
added 2 days ago4 views

EUVD-2026-53113

The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not perform any authorization check no capability, nonce, login, or ownership check on one of its shipping-label download endpoints, so an unauthenticated attacker can enumerate sequential ids and download every stored...

5.6AI score0.00136EPSS
SaveExploits0References1
EUVD
EUVD
added 2 days ago5 views

EUVD-2026-53114

The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not protect its shipping-label storage directory with server-independent access control, relying only on an Apache .htaccess file, so on a web server that does not honor .htaccess such as nginx an unauthenticated visitor...

3.7CVSS5.5AI score0.00171EPSS
SaveExploits0References1
CVE
CVE
added 2 days ago19 views

CVE-2026-16993

The CVE-2026-16993 entry concerns the DHL Shipping Germany for WooCommerce WordPress plugin (pre-4.0.1). The root cause is that the plugin’s shipping-label storage directory is not protected by server-independent access control and relies solely on an Apache .htaccess file. On servers that do not...

3.7CVSS5.5AI score0.00171EPSS
SaveExploits0References1
CVE
CVE
added 2 days ago17 views

CVE-2026-16981

The CVE-2026-16981 entry concerns the DHL Shipping Germany for WooCommerce WordPress plugin (pre-4.0.1). The vulnerability is an unauthenticated IDOR on a shipping-label download endpoint, where no authorization checks (capability, nonce, login, or ownership) are performed, allowing an unauthenti...

5.3CVSS5.6AI score0.00136EPSS
SaveExploits0References1
Rows per page
Query Builder