WordPress Moloni plugin < 5.0.14 - Subscriber+ Arbitrary Order Invoice Generation vulnerability

Subscriber+ Arbitrary Order Invoice Generation vulnerability discovered by Seongwon LEE in WordPress Plugin Moloni versions 5.0.14...

CVE-2026-106932

The Moloni WordPress plugin versions prior to 5.0.14 is vulnerable to an authorization bypass. The plugin fails to perform capability or nonce checks on several authenticated AJAX actions, relying instead on the presence of a stored connection to an external invoicing provider. This allows any au...

CVE-2026-106932 Moloni < 5.0.14 - Subscriber+ Arbitrary Order Invoice Generation via genInvoice

The Moloni WordPress plugin before 5.0.14 does not perform capability or nonce checks on several of its authenticated AJAX actions, relying only on whether the site holds a stored connection to its external invoicing provider, allowing any authenticated user such as a Subscriber to generate fisca...

CVE-2026-106932 Moloni < 5.0.14 - Subscriber+ Arbitrary Order Invoice Generation via genInvoice

The Moloni WordPress plugin before 5.0.14 does not perform capability or nonce checks on several of its authenticated AJAX actions, relying only on whether the site holds a stored connection to its external invoicing provider, allowing any authenticated user such as a Subscriber to generate fisca...

CVE-2026-111277 NivoCart through 2.5.1 Guest Order Invoice Disclosure via account/order/download

NivoCart through 2.5.1 contains a missing authorization vulnerability in the download action of account/order that allows unauthenticated attackers to retrieve guest order invoices by supplying an orderid. Attackers can iterate the orderid parameter, which matches guest orders stored with...

CVE-2026-111277

NivoCart versions through 2.5.1 are vulnerable to a missing authorization vulnerability in the download() action of the account/order component. Unauthenticated attackers can exploit this by supplying a specific order_id to retrieve guest order invoices. By iterating the order_id parameter, attac...

EUVD-2025-35208

Shopware vulnerable to Server-Side Request Forgery SSRF – order invoice...

Stored Cross-Site Scripting Vulnerability at Order Invoice in Cloud EC E-commerce System

Cloud EC e-commerce system hereinafter referred to as Cloud EC is a set of PHP + MYSQL-based open source e-commerce system software developed independently by Cloud MYSQL e-commerce Co. Cloud EC e-commerce system order invoice at the existence of stored cross-site scripting vulnerabilities. An...

Threat Outbreak Alert: Fake Order Invoice Shipping Information Email Messages on May 27, 2014

Medium Alert ID: 34351 First Published: 2014 May 27 13:30 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a shipping information invoice for the recipient. The email message attempts to convince the recipient to open the...

Threat Outbreak Alert: Fake Order Invoice Documents Email Messages on October 29, 2013

Medium Alert ID: 31526 First Published: 2013 October 29 14:17 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain an order invoice document for the recipient. The text in the email message attempts to convince the recipient ...

Threat Outbreak Alert: Fake Order Invoice Update Notification Email Messages on July 16, 2013

Medium Alert ID: 30115 First Published: 2013 July 17 14:17 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a revised order invoice notification for the recipient. The text in the email message attempts to convince the...