19137 matches found
EUVD-2026-63817
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not restrict access to per-vendor commission configuration returned by one of its unauthenticated store REST endpoints, allowing any unauthenticated user to disclose a vendor's commission type...
CVE-2026-16576
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 contains an improper access control flaw in its admin REST API routes. The affected endpoints check only for a WooCommerce management capability rather than the required Dokan-installation capability...
EUVD-2026-63814
The Tamara Checkout WordPress plugin through 1.9.9.20 does not verify the order key, a nonce, or any capability on its public payment cancel/fail return URLs, changing a WooCommerce order's status based solely on an attacker-supplied numeric order id, so an unauthenticated attacker can cancel or...
CVE-2026-16962
The Tamara Checkout WordPress plugin through 1.9.9.20 lacks verification of the order key, nonce, or any capability on its public payment cancel/fail return URLs. An unauthenticated attacker can change a WooCommerce order's status by supplying only a numeric order ID, enabling store-wide order ca...
CVE-2026-16962 Tamara Checkout <= 1.9.9.20 - Unauthenticated Order Status Manipulation
The Tamara Checkout WordPress plugin through 1.9.9.20 does not verify the order key, a nonce, or any capability on its public payment cancel/fail return URLs, changing a WooCommerce order's status based solely on an attacker-supplied numeric order id, so an unauthenticated attacker can cancel or...
CVE-2026-66682
Unauthenticated Privilege Escalation in Abandoned Cart Pro for WooCommerce = 10.4.0 versions...
CVE-2026-66611
Unauthenticated Cross Site Scripting XSS in Paymob for WooCommerce = 4.1.10 versions...
CVE-2026-66605
Unauthenticated Cross Site Scripting XSS in Swatchly – WooCommerce Variation Swatches for Products = 1.4.13 versions...
CVE-2026-74019
CVE-2026-74019 is an unauthenticated Broken Access Control vulnerability in the EPROLO Dropshipping WordPress plugin, affecting versions ≤ 2.4.2 . The vulnerability was discovered by hivesec and allows an unauthenticated attacker to access restricted functionality or data, resulting in high confi...
EUVD-2026-63319
Unauthenticated Broken Access Control in EPROLO Dropshipping = 2.4.2 versions...
CVE-2026-66682
CVE-2026-66682 is an unauthenticated privilege escalation vulnerability in the Abandoned Cart Pro for WooCommerce WordPress plugin, affecting versions
EUVD-2026-63307
Unauthenticated Privilege Escalation in Abandoned Cart Pro for WooCommerce = 10.4.0 versions...
CVE-2026-66682 WordPress Abandoned Cart Pro for WooCommerce plugin <= 10.4.0 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Abandoned Cart Pro for WooCommerce = 10.4.0 versions...
CVE-2026-66611 WordPress Paymob for WooCommerce plugin <= 4.1.10 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Paymob for WooCommerce = 4.1.10 versions...
CVE-2026-66611
CVE-2026-66611 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the Paymob for WooCommerce WordPress plugin, affecting versions ≤ 4.1.10 . The flaw was discovered by dutafi and rated CVSS 7.1 (HIGH) with a changed scope, indicating an attacker can execute scripts in a different s...
EUVD-2026-63296
Unauthenticated Cross Site Scripting XSS in Paymob for WooCommerce = 4.1.10 versions...
EUVD-2026-63294
Unauthenticated Cross Site Scripting XSS in Advance Product Search = 1.4.8 versions...
CVE-2026-66605 WordPress Swatchly – WooCommerce Variation Swatches for Products plugin <= 1.4.13 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Swatchly – WooCommerce Variation Swatches for Products = 1.4.13 versions...