19194 matches found
CVE-2026-27345 WordPress Taxi Booking Manager for WooCommerce plugin <= 2.0.3 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce = 2.0.3 versions...
CVE-2026-19088
The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout...
CVE-2026-18945
The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX actions, allowing unauthenticated users to view other customers' order details, including personal information, as well as change t...
CVE-2026-14182
The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the accoun...
CVE-2026-18945
The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX actions, allowing unauthenticated users to view other customers' order details, including personal information, as well as change t...
CVE-2026-19088 ShopEngine < 4.9.3 - Customer PII Disclosure via Forced Authentication
The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout...
CVE-2026-18945
CVE-2026-18945 concerns the WP Helper Premium WordPress plugin (before 4.7.6). The root cause is missing verification of the order key when rendering the custom order confirmation page and handling related AJAX actions, which allows unauthenticated users to view other customers’ order details (in...
CVE-2026-19088
The CVE-2026-19088 affects the ShopEngine Elementor WooCommerce Builder Addon for WordPress (older than 4.9.3). The issue is an CSRF vulnerability on an authentication endpoint, which can allow an attacker to log a victim into an attacker-controlled account. As a consequence, billing and shipping...
EUVD-2026-57729
The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout...
CVE-2026-18945 WP Helper Premium < 4.7.6 - Unauthenticated Order Data Disclosure and Order Manipulation via Missing Order Key Validation
The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX actions, allowing unauthenticated users to view other customers' order details, including personal information, as well as change t...
EUVD-2026-57728
The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX actions, allowing unauthenticated users to view other customers' order details, including personal information, as well as change t...
CVE-2026-14182 Customer Email Verification for WooCommerce < 3.2.6 - Unauthenticated Account Takeover via Type-Juggling Authentication Bypass
The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the accoun...
EUVD-2026-57726
The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the accoun...
CVE-2026-14182
The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the accoun...
CVE-2026-14182
The CVE-2026-14182 affects the Customer Email Verification for WooCommerce WordPress plugin prior to 3.2.6. The vulnerability stems from incorrect validation of the email-verification activation code, using a loose (type-j juggling) comparison that a crafted value can satisfy. This allows unauthe...
PT-2026-71503
Unauthenticated Privilege Escalation in MStore API = 4.20.0 versions...
PT-2026-71601
Administrator SQL Injection in MailChimp For WooCommerce 6.2 versions...
PT-2026-71551
Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce via CLINK = 1.0.7 versions...