CVE-2026-10104

The Product Video Gallery for Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via customthumbnail Parameter in all versions up to, and including, 1.5.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-1937

The YayMail – WooCommerce Email Customizer plugin for WordPress (versions up to and including 4.3.2 ) is vulnerable to privilege escalation due to a missing capability check on the yaymail_import_state AJAX action. Authenticated attackers with Shop Manager-level access or higher can exploit this ...