EUVD-2026-75528

Unauthenticated Broken Access Control in Return Refund and Exchange For WooCommerce = 4.6.4 versions...

CVE-2026-81799

An unauthenticated Broken Access Control vulnerability was discovered in the Return Refund and Exchange For WooCommerce WordPress plugin, affecting versions ≤ 4.6.4 . The flaw was identified by babyhack (@OPCIA) and carries a CVSS 3.1 score of 7.5 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C...

CVE-2026-81794

CVE-2026-81794 affects the Shirt Product Designer for WooCommerce plugin version 1.0.4 , introducing an unauthenticated Broken Access Control vulnerability. An attacker can exploit this over the network with low complexity, no required privileges, and no user interaction, resulting in a high impa...

EUVD-2026-75525

Unauthenticated Broken Access Control in Shirt Product Designer for WooCommerce 1.0.4 versions...

CVE-2026-81794 WordPress Shirt Product Designer for WooCommerce plugin 1.0.4 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Shirt Product Designer for WooCommerce 1.0.4 versions...

CVE-2026-81789 WordPress Advanced Product Fields Extended for WooCommerce plugin <= 3.1.6 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Studio Wombat Advanced Product Fields Extended for WooCommerce allows Path Traversal. This issue affects Advanced Product Fields Extended for WooCommerce: from n/a through 3.1.6...

CVE-2026-81789

Advanced Product Fields Extended for WooCommerce WordPress plugin, versions ≤ 3.1.6 , is affected by an unauthenticated arbitrary file deletion vulnerability. The CVSS 3.1 score is 8.6 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, indicating a network-exploitable issue requiring no...

EUVD-2026-75522

Unauthenticated Arbitrary File Deletion in Advanced Product Fields Extended for WooCommerce = 3.1.6 versions...

CVE-2026-81786 WordPress Thank You Page Customizer for WooCommerce plugin <= 1.2.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Thank You Page Customizer for WooCommerce = 1.2.2 versions...

CVE-2026-81786

Unauthenticated Broken Access Control in Thank You Page Customizer for WooCommerce = 1.2.2 versions...

EUVD-2026-75519

Unauthenticated Broken Access Control in Thank You Page Customizer for WooCommerce = 1.2.2 versions...

CVE-2026-78536 WordPress Robokassa payment gateway for Woocommerce plugin <= 1.8.9 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Robokassa payment gateway for Woocommerce = 1.8.9 versions...

CVE-2026-78536

CVE-2026-78536 affects the Robokassa payment gateway for Woocommerce WordPress plugin in versions 1.8.9 and earlier . The vulnerability is an unauthenticated Broken Access Control , meaning an attacker with no prior credentials can exploit it over the network. The CVSS 3.1 score is 6.5 (Medium) w...

EUVD-2026-75513

Unauthenticated Broken Access Control in Robokassa payment gateway for Woocommerce = 1.8.9 versions...

CVE-2017-17058-woo_exploit

此存储库没有 README。...

CVE-2025-12720

g-FFL Cockpit 'POST', 36: 'callback' = CLASS, 'handleenqueueonly', 37: 'permissioncallback' = fn = self::fflcockpitisallowedself::$fflckey, 38: ; fflcockpitisallowed 函数使用一个硬编码的 IP 地址（base64：My4yMTIuMTg1LjE4Nw==，解码后：3.212.185.187），该地址在插件源代码中可见。 来自 class-sync-endpoint.php 的漏洞代码片段： root@kitploit: 11...

hdwebmobile-photo-video-reviews

HDWebmobile 照片与视频评论 一款 WooCommerce 插件，允许客户在产品评论中附加照片和短视频，并直接显示在产品页面的评论列表中。 WordPress.org： https://wordpress.org/plugins/hdwebmobile-photo-video-reviews/ （等待首次提交） 要求： WordPress 6.9+、WooCommerce、PHP 7.4+ 许可证： GPLv2 或更高版本 此插件存在的原因 一款竞品“Customer Reviews for WooCommerce”插件附带了一个独立的 AJAX...

CVE-2026-54807

CVE-2026-54807 CVE-2026-54807 WooCommerce 权限提升 ║ ║ 通过注册表单进行未经验证的管理员角色分配 PRİV8 工具与漏洞利用频道: https://t.me/+zuUQbKSrHgwyZmI0...

CVE-2026-81431

The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post Contributor...

CVE-2026-78361

The zipMoneyZip Co Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation checks on one of its front-end request handlers, and does not restrict which option name a caller may supply, allowing unauthenticated users to delete arbitrary WordPress options...