WordPress eCommerce Product Catalog <3.0.39 - Cross-Site Scripting

WordPress eCommerce Product Catalog plugin before 3.0.39 contains a cross-site scripting vulnerability. The plugin does not escape the ic-settings-search parameter before outputting it back in the page in an attribute. This can allow an attacker to steal cookie-based authentication credentials an...

CVE-2026-120577 FluentCart A New Era of eCommerce <= 1.6.2 - Authenticated (Custom+) Arbitrary File Deletion via 'file_path' Parameter

The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFile function in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers,...

CVE-2026-120577

The FluentCart WordPress plugin (all versions up to and including 1.6.2 ) is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFile function. Authenticated attackers with custom-level access and above can exploit this to delete arbitrary files on the serv...

SMTP WP Plugin Directory Listing

The WordPress Easy WP SMTP Plugin has its log folder remotely accessible and its content available for access. id: CVE-2020-35234 info: name: SMTP WP Plugin Directory Listing author: PR3R00T severity: high description: The WordPress Easy WP SMTP Plugin has its log folder remotely accessible and i...

CVE-2026-2631

CVE-2026-2631 Datalogics Ecommerce Delivery – Datalogics PoC / Exploit Script: CVE-2026-2631.py Author: Khaled Alenazi Nxploited – Nxploited ZeroDay Hub Contact: Telegram: @Kxploit 🧬 Vulnerability Overview Plugin: Datalogics Ecommerce Delivery – Datalogics WordPress Affected Versions: 2.6.60...

CVE-2026-7393-RCE

Pizzafy Ecommerce System 1.0 – Unrestricted File Upload in savemenu Leads to Remote Code Execution Details Field| Value ---|--- Vendor| SourceCodester Vendor URL| https://www.sourcecodester.com Product| Pizzafy Ecommerce System using PHP and MySQL Product URL|...

CVE-2026-7394-SQLI

SQL Injection in Pizzafy Ecommerce System — admin/vieworder.php Details Field| Value ---|--- Vendor| SourceCodester Product| Pizzafy Ecommerce System using PHP and MySQL Version| 1.0 Vulnerability| SQL Injection CWE| CWE-89 CVSSv3 Score| 7.2 High Attack Vector| Network Auth Required| Yes...

SPA-Cart eCommerce CMS 1.9.0.3 - Cross-Site Scripting

A vulnerability was found in SPA-Cart eCommerce CMS 1.9.0.3. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /search. The manipulation of the argument filterbrandid/filterprice leads to cross site scripting. The attack may be launched remotely...

CVE-2021-39476

CVE-2021-39476 Found multiple XSS vulnerabilities within PhoenixCart 1.0.8.0 2x XSS on the same page "Edit the Category Title for SEO:" "Edit the Category Description" Link: https://www.warcloudsecurity.com/ecommerce/index.php?cPath=1...

CVE-2025-26865

CVE-2025-26865: FreeMarker Server-Side Template Injection via the "ecommerce" plugin in Apache OfBiz Due to a regression between 18.12.17 and 18.12.18 the fix for finding CVE-2022-25813: FreeMarker Server-Side Template Injection in Apache OfBiz was no longer enforced which reopened the possibilit...

CVE-2026-116851

Unauthenticated Cross Site Scripting XSS in eCommerce Product Catalog = 3.6.5 versions...

CVE-2026-116851 WordPress eCommerce Product Catalog plugin <= 3.6.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in eCommerce Product Catalog = 3.6.5 versions...

CVE-2026-116851

The eCommerce Product Catalog plugin for WordPress (versions

EUVD-2026-114308

Unauthenticated Cross Site Scripting XSS in eCommerce Product Catalog = 3.6.5 versions...

CVE-2026-116851 WordPress eCommerce Product Catalog plugin <= 3.6.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in eCommerce Product Catalog = 3.6.5 versions...

WordPress eCommerce Product Catalog plugin <= 3.6.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by pnn219 in WordPress Plugin eCommerce Product Catalog versions = 3.6.5...

PT-2026-133758

Name of the Vulnerable Software and Affected Versions eCommerce Product Catalog versions 3.6.5 and earlier Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication...

CVE-2026-116851: impleCode eCommerce Product Catalog: Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.6.5 versions.

Unauthenticated Cross Site Scripting XSS in eCommerce Product Catalog = 3.6.5 versions...

CVE-2026-115596

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Reflected XSS.This issue affects eCommerce Product Catalog: from n/a through 3.6.4...

CVE-2026-115596

The impleCode eCommerce Product Catalog WordPress plugin (versions up to and including 3.6.4 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The flaw arises from the Improper Neutralization of Input During Web Page Generation , allowing an attacker to execute malicious scripts in a user...