WordPress PayPlug for WooCommerce (Official) plugin 2.8.0-3.1.0 - Unauthenticated Arbitrary Order Deletion, Modification and Disclosure vulnerability

Unauthenticated Arbitrary Order Deletion, Modification and Disclosure vulnerability discovered by Sakri Rafael Koskimies in WordPress Plugin PayPlug for WooCommerce Official versions 2.8.0-3.1.0...

WordPress Menu Cart for WooCommerce plugin < 3.2.1 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Jakub Herman in WordPress Plugin WooCommerce Menu Cart versions 3.2.1...

WordPress UniPAY Payment Gateway For WooCommerce plugin <= 2.3 - Unauthenticated Order Payment Forgery vulnerability

Unauthenticated Order Payment Forgery vulnerability discovered by Naoki Kawahigashi in WordPress Plugin UniPAY Payment Gateway For WooCommerce versions = 2.3...

WordPress PayPlug for WooCommerce (Official) plugin 2.9.0-3.1.0 - Unauthenticated Order Key Disclosure and Order Cancellation vulnerability

Unauthenticated Order Key Disclosure and Order Cancellation vulnerability discovered by Filip Kecman in WordPress Plugin PayPlug for WooCommerce Official versions 2.9.0-3.1.0...

WordPress Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar plugin <= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter vulnerability

Authenticated Shop Manager+ Privilege Escalation to 'page' Parameter vulnerability discovered by Wordfence PRISM in WordPress Plugin WpEvently versions = 5.7.8...

CVE-2026-103313

The BitPay Gateway for WooCommerce WordPress plugin through 4.1.3 does not bind the payment provider's transaction confirmation to the order it completes, nor verify the confirmed amount, allowing an unauthenticated attacker who holds a single genuine low-value transaction to mark arbitrary...

CVE-2026-103313 BitPay Gateway for WooCommerce <= 4.1.3 - Unauthenticated Payment Bypass via Payment Return Handler

The BitPay Gateway for WooCommerce WordPress plugin through 4.1.3 does not bind the payment provider's transaction confirmation to the order it completes, nor verify the confirmed amount, allowing an unauthenticated attacker who holds a single genuine low-value transaction to mark arbitrary...

CVE-2026-103313

The BitPay Gateway for WooCommerce WordPress plugin (versions

EUVD-2026-111969

The BitPay Gateway for WooCommerce WordPress plugin through 4.1.3 does not bind the payment provider's transaction confirmation to the order it completes, nor verify the confirmed amount, allowing an unauthenticated attacker who holds a single genuine low-value transaction to mark arbitrary...

WordPress Checkout Files Upload for WooCommerce plugin < 2.4.0 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Josef Azizov Spoofable in WordPress Plugin Checkout Files Upload for WooCommerce versions 2.4.0...

CVE-2026-3891-Pix-for-WooCommerce-Plugin-Exploit

CVE-2026-3891-Pix-for-WooCommerce-Plugin-Exploit 🛡️ Description CVE-2026-3891 is a critical Unauthenticated Arbitrary File Upload vulnerability found in the Pix for WooCommerce WordPress plugin in versions up to and including 1.5.0. The vulnerability exists in the lknpixforwoocommercec6savesetting...

CVE-2026-111372

The AI ChatBot for WooCommerce – WoowBot plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, wit...

CVE-2026-111213

The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-109988

The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fieldssectionfieldsrowcoltype' parameter in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping. This...

WordPress Customer Email Verification for WooCommerce plugin <= 2.8.2 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Wordfence PRISM in WordPress Plugin Customer Email Verification for WooCommerce versions = 2.8.2...

CVE-2025-11391

Unauthenticated Blind SQL Injection in PPOM for WooCommerce prefix . PPOMTABLEMETA . " WHERE productmetaid = $metaid"; $res = $wpdb-getrow $qry ; return $res; An unauthenticated attacker can exploit this by crafting a malicious payload and injecting it into the ppomfieldsid parameter when adding ...

WordPress Product Designer for WooCommerce WordPress | Lumise plugin <= 2.1.2 - Unauthenticated Arbitrary File Read vulnerability

Unauthenticated Arbitrary File Read vulnerability discovered by Bao Le in WordPress Plugin Lumise Product Designer versions = 2.1.2...

CVE-2026-109988 Product Addons for Woocommerce <= 3.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'type' Field Parameter

The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fieldssectionfieldsrowcoltype' parameter in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping. This...

CVE-2026-109988

The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.1.8 . The root cause is insufficient input sanitization and output escaping within the fields[section][fields][row]...

EUVD-2026-111604

The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fieldssectionfieldsrowcoltype' parameter in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping. This...