CVE-2026-13039: Missing Authorization

The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to authorization bypass due to a regression in versions from 4.0.26 up to and including 4.1.15. This is due to the plugin not properly verifying that a user is authorized to perform a...

CVE-2026-3985

The Creative Mail – Easier WordPress & WooCommerce Email Marketing plugin for WordPress is vulnerable to SQL Injection via the 'checkoutuuid' parameter in all versions up to, and including, 1.6.9. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparati...

GHSA-88G2-XGH9-4PH2 OroCommerce get-totals-for-checkout API endpoint returns unwanted data

Detailed Checkout totals information may be received by Checkout ID...

OroCommerce get-totals-for-checkout API endpoint returns unwanted data

Detailed Checkout totals information may be received by Checkout ID...