CVE-2025-11391

ثغرة حقن SQL أعمى غير مصادق عليها في PPOM لـ WooCommerce = 33.0.15 يحتوي هذا المستودع على إثبات مفهوم PoC لثغرة حقن SQL أعمى قائمة على الوقت وغير مصادق عليها في إضافة "PPOM for WooCommerce" الخاصة بووردبريس، والتي تؤثر على الإصدارات حتى 33.0.15 وما يعادلها. تفاصيل الثغرة الإضافة: PPOM for...

WordPress Pricing Deals for WooCommerce <=2.0.2.02 - SQL Injection

WordPress Pricing Deals for WooCommerce plugin through 2.0.2.02 contains a SQL injection vulnerability. The plugin does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action. An attacker can possibly obtain sensitive information, modify data, and/or...

Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload

The Pix for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check and missing file type validation in the 'lknpixforwoocommercec6savesettings' function in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated...

CVE-2026-3891

🚀 CVE-2026-3891 – رفع ملفات غير مصادَق عليه في Pix for WooCommerce يؤدي إلى تنفيذ كود عن بُعد RCE إثبات المفهوم PoC لثغرة CVE-2026-3891 – رفع ملفات تعسفي غير مصادَق عليه يؤدي إلى تنفيذ كود عن بُعد في إضافة Pix for WooCommerce لووردبريس الإصدارات ≤ 1.5.0. 📖 نظرة عامة CVE-2026-3891 هي ثغرة حرجة في...

CVE-2026-3891-Pix-for-WooCommerce-Plugin-Exploit

CVE-2026-3891-Pix-for-WooCommerce-Plugin-Exploit 🛡️ الوصف CVE-2026-3891 هو ثغرة خطيرة من نوع رفع ملفات تعسفي بدون مصادقة Unauthenticated Arbitrary File Upload تم اكتشافها في إضافة Pix for WooCommerce لووردبريس في الإصدارات حتى 1.5.0 وما يشملها. توجد الثغرة في وظيفة...

EUVD-2026-66408

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 1.17.8 via the saveattachments function. This is due to missing file extension validation and missing path normalization whe...

CVE-2026-3891

Pix for WooCommerce = 1.5.0 - Nicht authentifizierter beliebiger Datei-Upload CVE-2026-3891 PoC 📜 Beschreibung CVE-2026-3891 ist eine Schwachstelle für nicht authentifizierten beliebigen Datei-Upload im WordPress-Plugin Pix for WooCommerce. Das Plugin stellt einen AJAX-Endpunkt...

CVE-2026-47100-Analysis-Lab

CVE-2026-47100 — FunnelKit / Funnel Builder for WooCommerce Checkout: Laboratorio di Stored XSS Laboratorio Docker locale per riprodurre CVE-2026-47100 in modo sicuro e con il minimo danno. Questo laboratorio confronta una versione vulnerabile di FunnelKit con una versione corretta e verifica il...

CVE-2026-3891-Linux

root@kitploit: ███████╗██████╗ ██╗███████╗███╗ ██╗██████╗ ███████╗ ██╔════╝██╔══██╗██║██╔════╝████╗ ██║██╔══██╗██╔════╝ █████╗ ██████╔╝██║█████╗ ██╔██╗ ██║██║ ██║███████╗ ██╔══╝ ██╔══██╗██║██╔══╝ ██║╚██╗██║██║ ██║╚════██║ ██║ ██║ ██║██║███████╗██║ ╚████║██████╔╝███████║ ╚═╝ ╚═╝ ╚═╝╚═╝╚══════╝╚═╝...

CVE-2025-11391

SQL Injection cieca non autenticata in PPOM for WooCommerce = 33.0.15 Questa repository contiene una prova di concetto PoC per una vulnerabilità di SQL injection cieca basata sul tempo non autenticata nel plugin WordPress "PPOM for WooCommerce", che interessa le versioni fino alla 33.0.15 inclusa...

CVE-2024-50510

CVE-2024-50510 AR For Woocommerce = 6.2 - Caricamento arbitrario di file senza autenticazione Descrizione Il plugin AR for WooCommerce per WordPress è vulnerabile a caricamenti arbitrari di file a causa della mancata validazione del tipo di file in tutte le versioni fino alla 6.2 inclusa. Ciò...

WordPress Gift Cards For WooCommerce Pro plugin < 4.2.10 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Brandon Steed in WordPress Plugin Gift Cards For WooCommerce Pro versions 4.2.10...

CVE-2026-66611

Unauthenticated Cross Site Scripting XSS in Paymob for WooCommerce = 4.1.10 versions...

CVE-2026-66611 WordPress Paymob for WooCommerce plugin <= 4.1.10 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Paymob for WooCommerce = 4.1.10 versions...

CVE-2026-66611

CVE-2026-66611 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the Paymob for WooCommerce WordPress plugin, affecting versions ≤ 4.1.10 . The flaw was discovered by dutafi and rated CVSS 7.1 (HIGH) with a changed scope, indicating an attacker can execute scripts in a different s...

CVE-2026-19709

The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan detail...

CVE-2026-19709

The Membership For WooCommerce WordPress plugin before 3.1.2 contains an unauthenticated data disclosure vulnerability in its REST API authentication logic. The plugin fails to verify that an API consumer secret has actually been generated before comparing it against the value supplied in a reque...

EUVD-2026-62291

The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan detail...

CVE-2026-19709 Membership For WooCommerce < 3.1.2 - Unauthenticated Member Data Disclosure via REST Consumer Secret Bypass

The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan detail...

CVE-2026-73345

Customer SQL Injection in License Manager for WooCommerce = 3.0.18 versions...