3083 matches found
PT-2026-84102
The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to generic SQL Injection via the 'product order' parameter in all versions up to, and including, 5.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...
WordPress eCommerce Product Catalog plugin <= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via 'style' Shortcode Attribute vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin eCommerce Product Catalog versions = 3.5.10...
WordPress CoCart plugin < 4.9.0 - Unauthenticated Arbitrary Price Manipulation vulnerability
Unauthenticated Arbitrary Price Manipulation vulnerability discovered by hoangphuong in WordPress Plugin CoCart – Headless ecommerce versions 4.9.0...
CVE-2026-76128
The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2026-76128
The eCommerce Product Catalog WordPress plugin (all versions up to 3.5.10 ) is vulnerable to Stored Cross-Site Scripting via the 'style' Shortcode Attribute due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or above can inject arbitr...
EUVD-2026-65357
The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2026-76128 eCommerce Product Catalog <= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute
The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2026-76128 eCommerce Product Catalog <= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute
The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2026-76128: Improper Neutralization of Input During Web Page Generation
The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
PT-2026-81248
Name of the Vulnerable Software and Affected Versions eCommerce Product Catalog versions prior to 3.5.11 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary...
CVE-2026-73399
Unauthenticated Broken Authentication in Flutterwave WooCommerce = 3.3.0 versions...
CVE-2026-15056: Improper Limitation of a Pathname to a Restricted Directory
The StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.1 via the parsefilepath function. This makes it possible for authenticated attackers, with vendor-level...
CVE-2026-14332
The Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin before 7.0.9 does not perform a capability check or nonce verification on one of its store-management actions, allowing any authenticated user, such as a subscriber, to disconnect the store and take the storefront offline until an...
CVE-2026-14332: Missing Authorization
The Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin before 7.0.9 does not perform a capability check or nonce verification on one of its store-management actions, allowing any authenticated user, such as a subscriber, to disconnect the store and take the storefront offline until an...
MAL-2026-13553 Malicious code in dolyame-boxy-independent-bnpl-product-grid (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 838978067dbfc6b266e91ac3f0255687d3b31364dfac82c9f992ded8ecd1ef36 On require of index.js, runtime.js selects a platform-specific payload path, rotates through hardcoded Cloudflare Workers hosts...
WordPress AI ChatBot for WooCommerce plugin < 4.8.4 - Unauthenticated Gemini API Key Abuse vulnerability
Unauthenticated Gemini API Key Abuse vulnerability discovered by Pedro Pinho in WordPress Plugin ChatBot for eCommerce WoowBot versions 4.8.4...
MAL-2026-12941 Malicious code in bnpl-blocks-desktop-bnpl-shopping-header (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 856f0990441190e7999b320510aeca70ac803d89f2e248bc7580b4b9b705718a On require of this package, index.js loads loader.js which selects a platform-specific asset linux/darwin/win32, downloads a binary over HTTPS from o...
CVE-2026-14927: Authorization Bypass Through User-Controlled Key
The FluentCart A New Era of eCommerce WordPress plugin before 1.5.3 does not perform any authorization or ownership check before rendering customer order documents keyed on a sequential numeric identifier, allowing unauthenticated visitors to enumerate and disclose customer personal data names,...