613 matches found
EUVD-2026-49723
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter of the POST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint in versions up to, and including, 6.2.0. This is due to insufficient escaping on the user-supplied...
CVE-2026-12800 Premium Packages <= 6.2.0 - Unauthenticated SQL Injection
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter of the POST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint in versions up to, and including, 6.2.0. This is due to insufficient escaping on the user-supplied...
CVE-2026-12800
The CVE-2026-12800 affects the Premium Packages – Sell Digital Products Securely plugin for WordPress (versions up to 6.2.0). A SQL Injection exists via the code parameter in the POST /wp-json/wpdmpp/v1/cart/coupon REST endpoint. Root cause: user-supplied code is interpolated directly into a raw ...
PT-2026-65412
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter of the POST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint in versions up to, and including, 6.2.0. This is due to insufficient escaping on the user-supplied...
PT-2026-65448
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'coupon code' parameter in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existi...
Brute Force
Overview craftcms/commerce is a Craft Commerce Affected versions of this package are vulnerable to Brute Force in the actionUpdateCart process when the 'number' parameter is not provided, which disables rate limiting. An attacker can enumerate valid coupon codes by sending automated requests...
GHSA-H5GM-X9WR-VHCM Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass
Summary The CartController defines a RateLimiter behavior that is only activated when the 'number' POST/GET parameter is explicitly provided. Details When an attacker submits coupon codes against the session-based cart without passing a 'number' parameter, no rate limiting is applied. This allows...
Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass
Summary The CartController defines a RateLimiter behavior that is only activated when the 'number' POST/GET parameter is explicitly provided. Details When an attacker submits coupon codes against the session-based cart without passing a 'number' parameter, no rate limiting is applied. This allows...
CVE-2026-9822 WP Hotel Booking < 2.3.1 - Subscriber+ Missing Authorization in Multiple AJAX Handlers
The WP Hotel Booking WordPress plugin before 2.3.1 does not enforce capability checks in several of its AJAX handlers, allowing authenticated users with Subscriber-level access to read other users' booking line items, enumerate active coupons, and read pricing data...
PT-2026-51114
Summary The CartController defines a RateLimiter behavior that is only activated when the 'number' POST/GET parameter is explicitly provided. Details When an attacker submits coupon codes against the session-based cart without passing a 'number' parameter, no rate limiting is applied. This allows...
EUVD-2026-36979
Unauthenticated Cross Site Scripting XSS in Coupon Affiliates = 7.5.3 versions...
CVE-2026-49068
Subscriber Sensitive Data Exposure in Coupon Affiliates = 7.8.1 versions...
CVE-2026-40770
Unauthenticated Cross Site Scripting XSS in Coupon Affiliates = 7.5.3 versions...
CVE-2026-49068 WordPress Coupon Affiliates plugin <= 7.8.1 - Sensitive Data Exposure vulnerability
Subscriber Sensitive Data Exposure in Coupon Affiliates = 7.8.1 versions...
CVE-2026-49068 WordPress Coupon Affiliates plugin <= 7.8.1 - Sensitive Data Exposure vulnerability
Subscriber Sensitive Data Exposure in Coupon Affiliates = 7.8.1 versions...
CVE-2026-49068
The CVE concerns the WordPress Coupon Affiliates plugin (versions
EUVD-2026-36875
Subscriber Sensitive Data Exposure in Coupon Affiliates = 7.8.1 versions...
CVE-2026-40770 WordPress Coupon Affiliates plugin <= 7.5.3 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Coupon Affiliates = 7.5.3 versions...