Lucene search
+L

756 matches found

CVE
CVE
β€’added 2026/09/17 6:00 a.m.β€’11 views

CVE-2026-91019

The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 contains a broken access control flaw: it does not restrict who can view its stored payment gateway configuration . As a result, any authenticated user with Contributor-level access or above can read the site's PayPal and Str...

SaveExploits0References1
CVE
CVE
β€’added 2026/09/17 6:00 a.m.β€’9 views

CVE-2026-91009

The Active Woot Products Tables for WooCommerce WordPress plugin, versions before 2.1.3 , lacks proper authorization and CSRF validation on certain AJAX actions. The CVELIST record identifies the specific vector as the woot_update_attachment action. Any authenticated user at the subscriber level ...

SaveExploits0References1
CVE
CVE
β€’added 2026/09/17 6:00 a.m.β€’9 views

CVE-2026-91008

Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 fails to perform an ownership or authorization check before rendering booking confirmation details. This allows unauthenticated attackers to retrieve registered attendees' personal informationβ€”including full name, email address, ...

SaveExploits0References1
Kitploit
Kitploit
β€’added 2026/09/17 1:45 a.m.β€’23 views

CVE-2025-11391

InyecciΓ³n SQL Ciega No Autenticada en PPOM para WooCommerce = 33.0.15 Este repositorio contiene una Prueba de Concepto PoC para una vulnerabilidad de inyecciΓ³n SQL ciega basada en tiempo no autenticada en el plugin "PPOM for WooCommerce" de WordPress, que afecta a las versiones hasta la 33.0.15...

9.8CVSS5.8AI score0.00928EPSS
SaveExploits1
Kitploit
Kitploit
β€’added 2026/09/16 11:15 p.m.β€’9 views

CVE-2026-3891

Pix for WooCommerce = 1.5.0 - Subida de Archivos Arbitraria No Autenticada CVE-2026-3891 PoC πŸ“œ DescripciΓ³n CVE-2026-3891 es una vulnerabilidad de subida de archivos arbitraria no autenticada en el plugin de WordPress Pix for WooCommerce. El plugin expone un endpoint AJAX...

9.8CVSS6.1AI score0.2506EPSS
SaveExploits13
Kitploit
Kitploit
β€’added 2026/09/16 8:58 p.m.β€’8 views

CVE-2026-3891-Pix-for-WooCommerce-Plugin-Exploit

CVE-2026-3891-Pix-for-WooCommerce-Plugin-Exploit πŸ›‘οΈ DescripciΓ³n CVE-2026-3891 es una vulnerabilidad crΓ­tica de Subida Arbitraria de Archivos no Autenticada encontrada en el plugin de WordPress Pix for WooCommerce en versiones hasta la 1.5.0 inclusive. La vulnerabilidad existe en la funcionalidad...

9.8CVSS5.9AI score0.2506EPSS
SaveExploits13
Kitploit
Kitploit
β€’added 2026/09/16 5:39 p.m.β€’10 views

CVE-2026-47100-Analysis-Lab

CVE-2026-47100 β€” Laboratorio de XSS almacenado en el checkout de FunnelKit / Funnel Builder para WooCommerce Laboratorio local con Docker para reproducir CVE-2026-47100 de forma segura y con el menor impacto posible. Este laboratorio compara una versiΓ³n vulnerable de FunnelKit con una versiΓ³n...

8.7CVSS5.9AI score0.00457EPSS
SaveExploits1
Kitploit
Kitploit
β€’added 2026/09/16 4:23 p.m.β€’8 views

CVE-2026-3891-Linux

root@kitploit: β–ˆβ–ˆβ–ˆβ–ˆβ–ˆβ–ˆβ–ˆβ•—β–ˆβ–ˆβ–ˆβ–ˆβ–ˆβ–ˆβ•— β–ˆβ–ˆβ•—β–ˆβ–ˆβ–ˆβ–ˆβ–ˆβ–ˆβ–ˆβ•—β–ˆβ–ˆβ–ˆβ•— β–ˆβ–ˆβ•—β–ˆβ–ˆβ–ˆβ–ˆβ–ˆβ–ˆβ•— β–ˆβ–ˆβ–ˆβ–ˆβ–ˆβ–ˆβ–ˆβ•— β–ˆβ–ˆβ•”β•β•β•β•β•β–ˆβ–ˆβ•”β•β•β–ˆβ–ˆβ•—β–ˆβ–ˆβ•‘β–ˆβ–ˆβ•”β•β•β•β•β•β–ˆβ–ˆβ–ˆβ–ˆβ•— β–ˆβ–ˆβ•‘β–ˆβ–ˆβ•”β•β•β–ˆβ–ˆβ•—β–ˆβ–ˆβ•”β•β•β•β•β• β–ˆβ–ˆβ–ˆβ–ˆβ–ˆβ•— β–ˆβ–ˆβ–ˆβ–ˆβ–ˆβ–ˆβ•”β•β–ˆβ–ˆβ•‘β–ˆβ–ˆβ–ˆβ–ˆβ–ˆβ•— β–ˆβ–ˆβ•”β–ˆβ–ˆβ•— β–ˆβ–ˆβ•‘β–ˆβ–ˆβ•‘ β–ˆβ–ˆβ•‘β–ˆβ–ˆβ–ˆβ–ˆβ–ˆβ–ˆβ–ˆβ•— β–ˆβ–ˆβ•”β•β•β• β–ˆβ–ˆβ•”β•β•β–ˆβ–ˆβ•—β–ˆβ–ˆβ•‘β–ˆβ–ˆβ•”β•β•β• β–ˆβ–ˆβ•‘β•šβ–ˆβ–ˆβ•—β–ˆβ–ˆβ•‘β–ˆβ–ˆβ•‘ β–ˆβ–ˆβ•‘β•šβ•β•β•β•β–ˆβ–ˆβ•‘ β–ˆβ–ˆβ•‘ β–ˆβ–ˆβ•‘ β–ˆβ–ˆβ•‘β–ˆβ–ˆβ•‘β–ˆβ–ˆβ–ˆβ–ˆβ–ˆβ–ˆβ–ˆβ•—β–ˆβ–ˆβ•‘ β•šβ–ˆβ–ˆβ–ˆβ–ˆβ•‘β–ˆβ–ˆβ–ˆβ–ˆβ–ˆβ–ˆβ•”β•β–ˆβ–ˆβ–ˆβ–ˆβ–ˆβ–ˆβ–ˆβ•‘ β•šβ•β• β•šβ•β• β•šβ•β•β•šβ•β•β•šβ•β•β•β•β•β•β•β•šβ•β•...

9.8CVSS5.9AI score0.2506EPSS
SaveExploits13
Nuclei
Nuclei
β€’added 2026/09/16 2:04 p.m.β€’102 views

WordPress Pricing Deals for WooCommerce <=2.0.2.02 - SQL Injection

WordPress Pricing Deals for WooCommerce plugin through 2.0.2.02 contains a SQL injection vulnerability. The plugin does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action. An attacker can possibly obtain sensitive information, modify data, and/or...

9.8CVSS8.3AI score0.08111EPSS
SaveExploits2References5
Nuclei
Nuclei
β€’added 2026/09/16 2:04 p.m.β€’6 views

VidShop for WooCommerce <= 1.1.4 - SQL Injection

VidShop – Shoppable Videos for WooCommerce plugin for WordPress = 1.1.4 contains a time-based SQL injection caused by insufficient escaping of the 'fields' parameter, letting unauthenticated attackers extract sensitive database information. id: CVE-2026-0702 info: name: VidShop for WooCommerce =...

7.5CVSS5.7AI score0.01348EPSS
SaveExploits0References3
Nuclei
Nuclei
β€’added 2026/09/16 2:04 p.m.β€’27 views

Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload

The Pix for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check and missing file type validation in the 'lknpixforwoocommercec6savesettings' function in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated...

9.8CVSS6.2AI score0.2506EPSS
SaveExploits13References2
NVD
NVD
β€’added 2026/09/16 6:16 a.m.β€’7 views

CVE-2026-87854

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing unauthenticated users to retrieve the store's full list of subscriptions, including customer usernames, product names, recurring amounts and...

0.00177EPSS
SaveExploits0References1
NVD
NVD
β€’added 2026/09/16 6:16 a.m.β€’7 views

CVE-2026-87860

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making...

0.00137EPSS
SaveExploits0References1
EUVD
EUVD
β€’added 2026/09/16 6:00 a.m.β€’8 views

EUVD-2026-80209

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making...

5.7AI score0.00137EPSS
SaveExploits0References1
EUVD
EUVD
β€’added 2026/09/16 6:00 a.m.β€’5 views

EUVD-2026-80208

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing unauthenticated users to retrieve the store's full list of subscriptions, including customer usernames, product names, recurring amounts and...

5.7AI score0.00177EPSS
SaveExploits0References1
Kitploit
Kitploit
β€’added 2026/09/12 3:31 p.m.β€’11 views

CVE-2025-11391

InyecciΓ³n SQL Ciega No Autenticada en PPOM para WooCommerce = 33.0.15 Este repositorio contiene una Prueba de Concepto PoC para una vulnerabilidad de inyecciΓ³n SQL ciega basada en tiempo no autenticada en el plugin de WordPress "PPOM for WooCommerce", que afecta a las versiones hasta la 33.0.15...

9.8CVSS5.8AI score0.00928EPSS
SaveExploits1
CVE
CVE
β€’added 2026/09/12 6:00 a.m.β€’10 views

CVE-2026-84023

BEAR – Bulk Editor and Products Manager Professional for WooCommerce , a WordPress plugin, is affected in versions before 1.2.2 . The vulnerability stems from the plugin's failure to verify a CSRF nonce or check user capabilities before allowing updates to taxonomy terms. An attacker can modify a...

6.5CVSS5.8AI score0.00112EPSS
SaveExploits0References1
Kitploit
Kitploit
β€’added 2026/09/11 6:27 p.m.β€’9 views

CVE-2024-50510

CVE-2024-50510 AR Para Woocommerce = 6.2 - Subida de Archivos Arbitraria No Autenticada DescripciΓ³n El plugin AR for WooCommerce para WordPress es vulnerable a subidas de archivos arbitrarias debido a la falta de validaciΓ³n del tipo de archivo en todas las versiones hasta la 6.2 inclusive. Esto...

10CVSS6.3AI score0.0102EPSS
SaveExploits0
Kitploit
Kitploit
β€’added 2026/09/11 4:15 p.m.β€’14 views

CVE-2026-3891

πŸš€ CVE-2026-3891 – Pix for WooCommerce Unauthenticated File Upload RCE Proof‑of‑Concept exploit for CVE-2026-3891 – unauthenticated arbitrary file upload leading to remote code execution in the Pix for WooCommerce WordPress plugin ≀ 1.5.0. πŸ“– Overview CVE-2026-3891 is a critical vulnerability in th...

9.8CVSS6.2AI score0.2506EPSS
SaveExploits13References2
NVD
NVD
β€’added 2026/09/11 11:16 a.m.β€’9 views

CVE-2026-82215

The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before acting on them, allowing unauthenticated attackers who know the store's merchant identifier to mark arbitrary orders as paid, or to cancel...

5.9CVSS0.00114EPSS
SaveExploits0References1
Rows per page
Query Builder