CVE-2026-105850 Payload: Order confirmation validation issue in Payload Ecommerce

Payload is a free and open source headless content management system. In @payloadcms/plugin-ecommerce versions before 3.90.0 and canary versions before 4.0.0-canary.34, use of the Stripe payment adapter can allow a Stripe order confirmation to be processed more than once under certain conditions...

CVE-2026-105850 Payload: Order confirmation validation issue in Payload Ecommerce

Payload is a free and open source headless content management system. In @payloadcms/plugin-ecommerce versions before 3.90.0 and canary versions before 4.0.0-canary.34, use of the Stripe payment adapter can allow a Stripe order confirmation to be processed more than once under certain conditions...

EUVD-2026-93493

Payload is a free and open source headless content management system. In @payloadcms/plugin-ecommerce versions before 3.90.0 and canary versions before 4.0.0-canary.34, use of the Stripe payment adapter can allow a Stripe order confirmation to be processed more than once under certain conditions...

CVE-2026-105850

The Payload headless content management system is vulnerable in @payloadcms/plugin-ecommerce versions before 3.90.0 and canary versions before 4.0.0-canary.34 . When using the Stripe payment adapter , certain conditions can cause a Stripe order confirmation to be processed more than once. This is...

CVE-2026-32578

Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce = 1.1.2606090 versions...

CVE-2026-32578 WordPress ECPay Ecommerce for WooCommerce plugin <= 1.1.2606090 - Broken Access Control vulnerability

Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce = 1.1.2606090 versions...

EUVD-2026-93239

Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce = 1.1.2606090 versions...

CVE-2026-32578 WordPress ECPay Ecommerce for WooCommerce plugin <= 1.1.2606090 - Broken Access Control vulnerability

Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce = 1.1.2606090 versions...

CVE-2026-32578

The ECPay Ecommerce for WooCommerce plugin for WordPress, version

CVE-2026-105850: Improper Enforcement of a Single, Unique Action

Payload is a free and open source headless content management system. In @payloadcms/plugin-ecommerce versions before 3.90.0 and canary versions before 4.0.0-canary.34, use of the Stripe payment adapter can allow a Stripe order confirmation to be processed more than once under certain conditions...

CVE-2026-32578: Missing Authorization

Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce = 1.1.2606090 versions...

PT-2026-106404

Name of the Vulnerable Software and Affected Versions ECPay Ecommerce for WooCommerce versions prior to 1.1.2606091 Description Broken access control allows users with the Subscriber role to perform unauthorized actions within the plugin. Recommendations Update ECPay Ecommerce for WooCommerce to ...

PT-2026-106782

Name of the Vulnerable Software and Affected Versions @payloadcms/plugin-ecommerce versions prior to 3.90.0 @payloadcms/plugin-ecommerce versions prior to 4.0.0-canary.34 Description When using the Stripe payment adapter, a Stripe order confirmation can be processed multiple times under certain...

CVE-2026-105056

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Stored XSS.This issue affects eCommerce Product Catalog: from n/a through 3.6.2...

EUVD-2026-92317

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Stored XSS.This issue affects eCommerce Product Catalog: from n/a through 3.6.2...

CVE-2026-105056

The impleCode eCommerce Product Catalog plugin for WordPress versions up to and including 3.6.2 is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. This vulnerability stems from the improper neutralization of input during web page generation . An attacker could potentially execute maliciou...

CVE-2026-105056 WordPress eCommerce Product Catalog plugin <= 3.6.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Stored XSS.This issue affects eCommerce Product Catalog: from n/a through 3.6.2...

CVE-2026-105056 WordPress eCommerce Product Catalog plugin <= 3.6.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Stored XSS.This issue affects eCommerce Product Catalog: from n/a through 3.6.2...

WordPress eCommerce Product Catalog plugin <= 3.6.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin eCommerce Product Catalog versions = 3.6.2...

CVE-2026-105056: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Stored XSS.This issue affects eCommerce Product Catalog: from n/a through 3.6.2...