CVE-2026-47696

WWBN AVideo is an open source video platform. In 29.0 and earlier, plugin/AuthorizeNet/processPayment.json.php credits the logged-in user's wallet based only on the attacker-controlled amount POST parameter. The endpoint contains a TODO for real Authorize.Net charging, hardcodes $paymentSuccess =...

CVE-2025-15033

A vulnerability in the WooCommerce WordPress plugin (versions 8.1 through 10.4.2 ) allows logged-in customers to access order data belonging to guest customers on sites with specific configurations. This sensitive data exposure flaw can be exploited by authenticated users to view unauthorized inf...

WordPress Users to CSV plugin cross-site request forgery vulnerability

WordPress is a blogging platform developed using the PHP language that allows users to set up their own websites on servers that support PHP and MySQL databases. WordPress can also be used as a content management system CMS. A cross-site request forgery vulnerability exists in the WordPress Users...