CVE-2024-0399

CVE-2024-0399 - WooCommerce Customers Manager 29.4 - Post-Authenticated SQL Injection Exploit Title: WooCommerce Customers Manager 29.4 - Post-Authenticated SQL Injection Date: 2024-03-25 Exploit Author: Ivan Spiridonov - xbz0n Software Link:...

CVE-2026-3629

CVE-2026-3629 - WordPress Privilege Escalation Checker A command-line tool to detect CVE-2026-3629 , a critical privilege escalation vulnerability in the "Import and export users and customers" WordPress plugin. 📢 Join Our Community Stay updated with the latest security tools, vulnerabilities, an...

CVE-2026-128033 OpenMage magento-lts before 20.18.2 Information Disclosure via Order-Status RSS Feed

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an information disclosure vulnerability in MageRssModelResourceOrder::getAllCommentCollection, which omits the isvisibleonfront filter for invoice, shipment and credit-memo comments. Authenticated customers can open...

CVE-2026-128033

The OpenMage magento-lts platform is affected by an information disclosure vulnerability in versions before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3. The root cause is located in the Mage_Rss_Model_Resource_Order::getAllCommentCollection() function, which fails to apply the is_visible_on_fron...

CVE-2026-120741

The MotoPress Appointment Booking Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.8 via the public '/motopress/appointment/v1/customers/create' REST endpoint. The route is registered with permissioncallback = 'returntrue' and the...

EUVD-2026-118570

The MotoPress Appointment Booking Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.8 via the public '/motopress/appointment/v1/customers/create' REST endpoint. The route is registered with permissioncallback = 'returntrue' and the...

CVE-2026-120741 MotoPress Appointment Booking <= 2.4.8 - Unauthenticated Stored Cross-Site Scripting via Customer Name via /customers/create REST Endpoint

The MotoPress Appointment Booking Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.8 via the public '/motopress/appointment/v1/customers/create' REST endpoint. The route is registered with permissioncallback = 'returntrue' and the...

CVE-2026-120741

The MotoPress Appointment Booking Lite plugin for WordPress (versions up to and including 2.4.8 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists in the public /motopress/appointment/v1/customers/create REST endpoint, which lacks proper permission checks (permission_callback ...

CVE-2026-120554

The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.5.11 This is due to a non-atomic multi-option write sequence in the ACUICron::savesettings function, which persists acuicronactivated, acuicronconfiguredby,...

CVE-2026-120554 Import and export users and customers <= 2.5.11 - Authenticated (Custom+) Privilege Escalation via Non-Atomic Cron Settings Save

The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.5.11 This is due to a non-atomic multi-option write sequence in the ACUICron::savesettings function, which persists acuicronactivated, acuicronconfiguredby,...

CVE-2026-120554

The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 2.5.11 . The flaw exists in the ACUI_Cron::save_settings() function due to a non-atomic multi-option write sequence . The function persists several settings—includi...

EUVD-2026-116806

The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.5.11 This is due to a non-atomic multi-option write sequence in the ACUICron::savesettings function, which persists acuicronactivated, acuicronconfiguredby,...

WordPress Import and export users and customers plugin <= 2.5.11 - Authenticated (Custom+) Privilege Escalation vulnerability

Authenticated Custom+ Privilege Escalation vulnerability discovered by Abdul Halim in WordPress Plugin Import and export users and customers versions = 2.5.11...

EUVD-2026-116591

Bagisto before 2.4.5 contains a stored cross-site scripting vulnerability that allows authenticated customers to upload HTML files via the RMA send-message endpoint without type or extension validation. Attackers can upload a .html attachment containing JavaScript served under...

CVE-2026-121733

Bagisto before 2.4.5 contains a stored cross-site scripting vulnerability that allows authenticated customers to upload HTML files via the RMA send-message endpoint without type or extension validation. Attackers can upload a .html attachment containing JavaScript served under...

PT-2026-136912

Name of the Vulnerable Software and Affected Versions Import and export users and customers plugin for WordPress versions prior to 2.5.12 Description An issue exists due to a non-atomic multi-option write sequence in the ACUI Cron::save settings function. The system persists the variables acui cr...

CVE-2026-62991 Shopper: customer detail IDOR exposes administrator and staff records

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route /cpanel/customers/user/show in packages/admin/src/Livewire/Pages/Customers/Show.php checks readcustomers but looks up an arbitrary user ID without applying the customers role scope used by the listing...

CVE-2026-62991 Shopper: customer detail IDOR exposes administrator and staff records

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route /cpanel/customers/user/show in packages/admin/src/Livewire/Pages/Customers/Show.php checks readcustomers but looks up an arbitrary user ID without applying the customers role scope used by the listing...

CVE-2026-62991 Shopper: customer detail IDOR exposes administrator and staff records

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route /cpanel/customers/user/show in packages/admin/src/Livewire/Pages/Customers/Show.php checks readcustomers but looks up an arbitrary user ID without applying the customers role scope used by the listing...

CVE-2026-62991

The Shopper Headless e-commerce Admin Panel is vulnerable to an IDOR (Insecure Direct Object Reference) flaw in versions prior to 2.10.1 . The customer detail route (/cpanel/customers/{user}/show) in packages/admin/src/Livewire/Pages/Customers/Show.php fails to apply the required customers role s...