WordPress Shipping for Nova Poshta plugin 1.18.7-1.19.8 - Unauthenticated Order Shipment Record Deletion vulnerability

Unauthenticated Order Shipment Record Deletion vulnerability discovered by Emiliano Carrizo in WordPress Plugin Shipping for Nova Poshta versions 1.18.7-1.19.8...

CVE-2026-87846

The Shipping for Nova Poshta WordPress plugin through 1.19.8 does not perform any authorisation, nonce or ownership checks on one of its AJAX actions available to unauthenticated users, allowing anyone to delete the shipment records of arbitrary orders and to make the store issue the carrier's...

EUVD-2026-95707

The Shipping for Nova Poshta WordPress plugin through 1.19.8 does not perform any authorisation, nonce or ownership checks on one of its AJAX actions available to unauthenticated users, allowing anyone to delete the shipment records of arbitrary orders and to make the store issue the carrier's...

CVE-2026-87846

The Shipping for Nova Poshta WordPress plugin (versions 1.18.7 through 1.19.8 ) contains a vulnerability where an AJAX action lacks authorization, nonce, or ownership checks. This allows unauthenticated users to delete shipment records for arbitrary orders. Additionally, attackers can force the s...

CVE-2026-87846 Shipping for Nova Poshta 1.18.7 - 1.19.8 - Unauthenticated Order Shipment Record Deletion

The Shipping for Nova Poshta WordPress plugin through 1.19.8 does not perform any authorisation, nonce or ownership checks on one of its AJAX actions available to unauthenticated users, allowing anyone to delete the shipment records of arbitrary orders and to make the store issue the carrier's...

PT-2026-108872

Name of the Vulnerable Software and Affected Versions Shipping for Nova Poshta WordPress plugin versions prior to 1.19.9 Description An issue exists where an AJAX action available to unauthenticated users lacks authorization, nonce, or ownership checks. This allows an attacker to delete shipment...

EUVD-2025-3816

Malicious code in bioql PyPI...

CVE-2025-24612

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Ihor Kit Shipping for Nova Poshta nova-poshta-ttn allows SQL Injection.This issue affects Shipping for Nova Poshta: from n/a through = 1.19.6...

CVE-2025-24612

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Ihor Kit Shipping for Nova Poshta nova-poshta-ttn allows SQL Injection.This issue affects Shipping for Nova Poshta: from n/a through = 1.19.6...

CVE-2025-24612

CVE-2025-24612: Affected product is WordPress Shipping for Nova Poshta plugin (versions n/a through 1.19.6). The root cause is improper neutralization of special elements used in SQL commands, enabling SQL injection. Exploitation details are not described in the provided sources, but the CVSS met...

CVE-2025-24612 WordPress Shipping for Nova Poshta plugin <= 1.19.6 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Ihor Kit Shipping for Nova Poshta nova-poshta-ttn allows SQL Injection.This issue affects Shipping for Nova Poshta: from n/a through = 1.19.6...

CVE-2025-24612 WordPress Shipping for Nova Poshta plugin <= 1.19.6 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Ihor Kit Shipping for Nova Poshta nova-poshta-ttn allows SQL Injection.This issue affects Shipping for Nova Poshta: from n/a through = 1.19.6...

CVE-2025-24612: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Ihor Kit Shipping for Nova Poshta nova-poshta-ttn allows SQL Injection.This issue affects Shipping for Nova Poshta: from n/a through = 1.19.6...

WordPress plugin Shipping for Nova Poshta SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection...

PT-2025-5447 · Unknown · Morkva Shipping For Nova Poshta

Name of the Vulnerable Software and Affected Versions: MORKVA Shipping for Nova Poshta versions n/a through 1.19.6 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection,...

WordPress Shipping for Nova Poshta plugin <= 1.19.6 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Shipping for Nova Poshta versions = 1.19.6...

WordPress Shipping for Nova Poshta Plugin <= 1.7.47 is vulnerable to Cross Site Scripting (XSS)

Software Shipping for Nova Poshta Type Plugin Vulnerable versions = 1.7.47 Fixed in 1.8.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID a97af6310cdb Credits Rafie Muhammad Patchstack...