WordPress B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More plugin < 5.2.40 - Unauthenticated B2B Group Assignment and Approval Bypass vulnerability

Unauthenticated B2B Group Assignment and Approval Bypass vulnerability discovered by Farid Narimanov in WordPress Plugin B2BKing versions 5.2.40...

CVE-2026-85038

The B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More WordPress plugin before 5.2.40 does not verify that a role selected during registration is one actually offered on the registration form, allowing unauthenticated users to assign themselves to...

CVE-2026-85038

The B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin for WordPress (versions before 5.2.40 ) is vulnerable to an unauthenticated B2B group assignment and approval bypass . The root cause is a failure to verify that a role selected during registration matches the options actually offered on...

EUVD-2026-72066

The B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More WordPress plugin before 5.2.40 does not verify that a role selected during registration is one actually offered on the registration form, allowing unauthenticated users to assign themselves to...

CVE-2026-85038 B2BKing < 5.2.40 - Unauthenticated B2B Group Assignment and Approval Bypass via Registration Role Selection

The B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More WordPress plugin before 5.2.40 does not verify that a role selected during registration is one actually offered on the registration form, allowing unauthenticated users to assign themselves to...

CVE-2026-85038 B2BKing < 5.2.40 - Unauthenticated B2B Group Assignment and Approval Bypass via Registration Role Selection

The B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More WordPress plugin before 5.2.40 does not verify that a role selected during registration is one actually offered on the registration form, allowing unauthenticated users to assign themselves to...

CVE-2026-85038: Missing Authorization

The B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More WordPress plugin before 5.2.40 does not verify that a role selected during registration is one actually offered on the registration form, allowing unauthenticated users to assign themselves to...

PT-2026-86486

The B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More WordPress plugin before 5.2.40 does not verify that a role selected during registration is one actually offered on the registration form, allowing unauthenticated users to assign themselves to...

CVE-2026-66598

Unauthenticated Cross Site Scripting XSS in B2BKing Premium = 5.6.07 versions...

CVE-2026-66598 WordPress B2BKing Premium plugin <= 5.6.07 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in B2BKing Premium = 5.6.07 versions...

EUVD-2026-63340

Unauthenticated Cross Site Scripting XSS in B2BKing Premium = 5.6.07 versions...

CVE-2026-66598

CVE-2026-66598 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress plugin B2BKing Premium , affecting versions 5.6.07 and earlier . The vulnerability was discovered by dutafi and is rated CVSS 7.1 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating ...

CVE-2026-66598: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in B2BKing Premium = 5.6.07 versions...

PT-2026-78961

Unauthenticated Cross Site Scripting XSS in B2BKing Premium = 5.6.07 versions...

WordPress B2BKing Premium plugin <= 5.6.07 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin B2BKing Premium versions = 5.6.07...

EUVD-2026-62211

Missing Authorization vulnerability in Kings Plugins B2BKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects B2BKing: from n/a through 5.2.30...

CVE-2026-66589

Missing Authorization vulnerability in Kings Plugins B2BKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects B2BKing: from n/a through 5.2.30...

CVE-2026-66589 WordPress B2BKing plugin <= 5.2.30 - Broken Access Control vulnerability

Missing Authorization vulnerability in Kings Plugins B2BKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects B2BKing: from n/a through 5.2.30...

CVE-2026-66589

The B2BKing WordPress plugin (versions through 5.2.30) has a Missing Authorization flaw in its access control, allowing low-privilege users to bypass security levels. CVSS 5.4 MEDIUM reflects low confidentiality and integrity impact. No patch version or exploit details are provided in the documen...

WordPress B2BKing plugin <= 5.2.30 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin B2BKing versions = 5.2.30...