CVE-2021-39476

CVE-2021-39476 Found multiple XSS vulnerabilities within PhoenixCart 1.0.8.0 2x XSS on the same page "Edit the Category Title for SEO:" "Edit the Category Description" Link: https://www.warcloudsecurity.com/ecommerce/index.php?cPath=1...

CVE-2026-2631

CVE-2026-2631 Datalogics Ecommerce Delivery – Datalogics PoC / Exploit Script: CVE-2026-2631.py Author: Khaled Alenazi Nxploited – Nxploited ZeroDay Hub Contact: Telegram: @Kxploit 🧬 Vulnerability Overview Plugin: Datalogics Ecommerce Delivery – Datalogics WordPress Affected Versions: 2.6.60...

CVE-2026-7393-RCE

Pizzafy Ecommerce System 1.0 – Unrestricted File Upload in savemenu Leads to Remote Code Execution Details...

CVE-2026-54645

CubeCart is an e-commerce platform where a stored XSS vulnerability exists in the product management panel prior to version 6.7.5. In admin/sources/products.index.inc.php (lines 55–59), the application bypasses its global sanitizer by reading description, description_short, and spec_copy fields d...

CVE-2026-54643

CubeCart prior to version 6.7.5 is affected by a missing authorization check in the delete-note handler (admin/sources/orders.index.inc.php). The handler verifies only the presence of order_id and delete-note parameters before deleting records from CubeCart_order_notes, without requiring the CC_P...

CVE-2026-54643 CubeCart: Missing Authorization Check for Order Note Deletion in orders.index.inc.php

CubeCart is an ecommerce software solution. Prior to 6.7.5, the delete-note handler in admin/sources/orders.index.inc.php verifies only the presence of orderid and delete-note parameters before deleting records from CubeCartordernotes, without requiring CCPERMDELETE for orders. An authenticated...

CVE-2021-27190-PEEL-Shopping-cart-9.3.0-Stored-XSS

CVE-2021-27190 - PEEL Shopping, eCommerce shopping cart - Stored Cross-Site Scripting Vulnerability in 'Address' Date 2021-02-11 Exploit Author Anmol K Sachan Vendor Homepage https://www.peel.fr/ Software Link https://www.peel.fr/nos-offres-1/peel-shopping-31.html...

CVE-2026-7394-SQLI

SQL Injection in Pizzafy Ecommerce System — admin/vieworder.php Details...

SMTP WP Plugin Directory Listing

The WordPress Easy WP SMTP Plugin has its log folder remotely accessible and its content available for access. id: CVE-2020-35234 info: name: SMTP WP Plugin Directory Listing author: PR3R00T severity: high description: The WordPress Easy WP SMTP Plugin has its log folder remotely accessible and i...

SPA-Cart eCommerce CMS 1.9.0.3 - Cross-Site Scripting

A vulnerability was found in SPA-Cart eCommerce CMS 1.9.0.3. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /search. The manipulation of the argument filterbrandid/filterprice leads to cross site scripting. The attack may be launched remotely...

WordPress eCommerce Product Catalog <3.0.39 - Cross-Site Scripting

WordPress eCommerce Product Catalog plugin before 3.0.39 contains a cross-site scripting vulnerability. The plugin does not escape the ic-settings-search parameter before outputting it back in the page in an attribute. This can allow an attacker to steal cookie-based authentication credentials an...

CVE-2026-90896

Missing Authentication for Critical Function CWE-306 in the checkout session lookup handler src/app/api/stripe/checkoutsessions/route.ts, exposed at GET /api/stripe/checkoutsessions, in MarcosCamara01 Ecommerce Template before commit 91e273c allows a remote, unauthenticated attacker holding a val...

CVE-2026-90896

CVE-2026-90896 is a Missing Authentication for Critical Function (CWE-306) in the MarcosCamara01 Ecommerce Template before commit 91e273c . The GET /api/stripe/checkout_sessions endpoint (in src/app/api/stripe/checkout_sessions/route.ts) calls stripe.checkout.sessions.retrieve() and returns the f...

EUVD-2026-78142

Missing Authentication for Critical Function CWE-306 in the checkout session lookup handler src/app/api/stripe/checkoutsessions/route.ts, exposed at GET /api/stripe/checkoutsessions, in MarcosCamara01 Ecommerce Template before commit 91e273c allows a remote, unauthenticated attacker holding a val...

CVE-2026-90896 Missing authentication in Ecommerce Template checkout session endpoint allows unauthenticated disclosure of buyer PII

Missing Authentication for Critical Function CWE-306 in the checkout session lookup handler src/app/api/stripe/checkoutsessions/route.ts, exposed at GET /api/stripe/checkoutsessions, in MarcosCamara01 Ecommerce Template before commit 91e273c allows a remote, unauthenticated attacker holding a val...

CVE-2026-90896 Missing authentication in Ecommerce Template checkout session endpoint allows unauthenticated disclosure of buyer PII

Missing Authentication for Critical Function CWE-306 in the checkout session lookup handler src/app/api/stripe/checkoutsessions/route.ts, exposed at GET /api/stripe/checkoutsessions, in MarcosCamara01 Ecommerce Template before commit 91e273c allows a remote, unauthenticated attacker holding a val...

CVE-2025-26865

CVE-2025-26865: FreeMarker Server-Side Template Injection via the "ecommerce" plugin in Apache OfBiz Due to a regression between 18.12.17 and 18.12.18 the fix for finding CVE-2022-25813: FreeMarker Server-Side Template Injection in Apache OfBiz was no longer enforced which reopened the possibilit...

CVE-2026-84099 IDB Ecommerce (wpStoreCart 5) <= 5.0.7 - Unauthenticated PHP Object Injection via bundled wpsc-membership-pro paypal.php

The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthenticated access to a bundled add-on that deserializes user-supplied input without restricting the permitted classes, allowing unauthenticated attackers to inject arbitrary PHP objects, which may be escalated further wh...

CVE-2026-17589

The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to generic SQL Injection via the 'productorder' parameter in all versions up to, and including, 5.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...

CVE-2026-17589

The Shopping Cart & eCommerce Store (WP EasyCart) plugin for WordPress is vulnerable to a second-order SQL injection via the product_order parameter in versions up to 5.9.2 . The payload is written to the ec_pageoption table via the ec_ajax_save_page_options handler with no sanitization on raw $_...