756 matches found
CVE-2026-91019
The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 contains a broken access control flaw: it does not restrict who can view its stored payment gateway configuration . As a result, any authenticated user with Contributor-level access or above can read the site's PayPal and Str...
CVE-2026-91009
The Active Woot Products Tables for WooCommerce WordPress plugin, versions before 2.1.3 , lacks proper authorization and CSRF validation on certain AJAX actions. The CVELIST record identifies the specific vector as the woot_update_attachment action. Any authenticated user at the subscriber level ...
CVE-2026-91008
Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 fails to perform an ownership or authorization check before rendering booking confirmation details. This allows unauthenticated attackers to retrieve registered attendees' personal informationโincluding full name, email address, ...
CVE-2025-11391
Unauthenticated Blind SQL Injection in PPOM for WooCommerce = 33.0.15 This repository contains a Proof of Concept PoC for an unauthenticated time-based blind SQL Injection vulnerability in the "PPOM for WooCommerce" WordPress plugin, affecting versions up to and including 33.0.15. Vulnerability...
CVE-2026-47100-Analysis-Lab
CVE-2026-47100 โ FunnelKit / Funnel Builder for WooCommerce Checkout Stored XSS Lab Local Docker lab for reproducing CVE-2026-47100 in a safe, least-harm way. This lab compares a vulnerable FunnelKit version against a patched version and verifies the behavior using a harmless JavaScript...
CVE-2026-3891-Linux
root@kitploit: โโโโโโโโโโโโโโโ โโโโโโโโโโโโโโโ โโโโโโโโโโ โโโโโโโโ โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ โโโโโโโโโโโโโโโโโโโ โโโโโโ โโโโโโโโโโโโโโโโโ โโโโโโ โโโโโโ โโโโโโโโโโโ โโโโโโ โโโโโโโโโโโโโโโโโ โโโโโโโโโโโโโ โโโโโโโโโโโ โโโ โโโ โโโโโโโโโโโโโโโโโ โโโโโโโโโโโโโโโโโโโโโโ โโโ โโโ โโโโโโโโโโโโโโโโโ...
WordPress Pricing Deals for WooCommerce <=2.0.2.02 - SQL Injection
WordPress Pricing Deals for WooCommerce plugin through 2.0.2.02 contains a SQL injection vulnerability. The plugin does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action. An attacker can possibly obtain sensitive information, modify data, and/or...
VidShop for WooCommerce <= 1.1.4 - SQL Injection
VidShop โ Shoppable Videos for WooCommerce plugin for WordPress = 1.1.4 contains a time-based SQL injection caused by insufficient escaping of the 'fields' parameter, letting unauthenticated attackers extract sensitive database information. id: CVE-2026-0702 info: name: VidShop for WooCommerce =...
Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload
The Pix for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check and missing file type validation in the 'lknpixforwoocommercec6savesettings' function in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated...
CVE-2026-3891
Pix for WooCommerce --command --timeout --useragent ไบคไบๅผ Shel...
CVE-2026-3891-Pix-for-WooCommerce-Plugin-Exploit
CVE-2026-3891-Pix-for-WooCommerce-ๆไปถ-ๅฉ็จ ๐ก๏ธ ๆ่ฟฐ CVE-2026-3891 ๆฏไธไธชไธฅ้็ๆช็ป่ฎค่ฏ็ไปปๆๆไปถไธไผ ๆผๆด ๏ผๅญๅจไบ Pix for WooCommerce WordPress ๆไปถไธญ๏ผๅฝฑๅ็ๆฌ่ณ 1.5.0๏ผๅซ๏ผ ใ ่ฏฅๆผๆดๅญๅจไบ lknpixforwoocommercec6savesettings ๅ่ฝไธญ๏ผๅๅ ๆฏ็ผบๅฐๆๆๆงๅถไธๆไปถ็ฑปๅ้ช่ฏไธ่ถณใๆญคๅฉ็จๅทฅๅ ท่ชๅจ่ทๅๆๆ nonce๏ผๅนถๆผ็คบไบๅฐ PHP ๆไปถๆ ้ๅถไธไผ ๅฐ Web ๅฏ่ฎฟ้ฎ็ฎๅฝ็่ฟ็จใ ้่ฟๅฉ็จๆญคๆผๆด๏ผๆช็ป่ฎค่ฏ็ๆปๅป่ ๅฏ่ฝ่ฝๅค๏ผ ไธไผ ไปปๆๆไปถ ๏ผๆ ้ WordPress ่ฎค่ฏใ...
CVE-2026-87860
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making...
CVE-2026-87854
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing unauthenticated users to retrieve the store's full list of subscriptions, including customer usernames, product names, recurring amounts and...
EUVD-2026-80209
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making...
EUVD-2026-80208
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing unauthenticated users to retrieve the store's full list of subscriptions, including customer usernames, product names, recurring amounts and...
CVE-2025-11391
Unauthenticated Blind SQL Injection in PPOM for WooCommerce = 33.0.15 This repository contains a Proof of Concept PoC for an unauthenticated time-based blind SQL Injection vulnerability in the "PPOM for WooCommerce" WordPress plugin, affecting versions up to and including 33.0.15. Vulnerability...
CVE-2026-84023
BEAR โ Bulk Editor and Products Manager Professional for WooCommerce , a WordPress plugin, is affected in versions before 1.2.2 . The vulnerability stems from the plugin's failure to verify a CSRF nonce or check user capabilities before allowing updates to taxonomy terms. An attacker can modify a...
CVE-2024-50510
CVE-2024-50510 AR For Woocommerce = 6.2 - Unauthenticated Arbitrary File Upload Description The AR for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 6.2. This makes it possible for unauthenticated...
CVE-2026-3891
๐ CVE-2026-3891 โ Pix for WooCommerce Unauthenticated File Upload RCE ProofโofโConcept exploit for CVE-2026-3891 โ unauthenticated arbitrary file upload leading to remote code execution in the Pix for WooCommerce WordPress plugin โค 1.5.0. ๐ Overview CVE-2026-3891 is a critical vulnerability in th...
CVE-2026-82215
The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before acting on them, allowing unauthenticated attackers who know the store's merchant identifier to mark arbitrary orders as paid, or to cancel...