CVE-2026-104727

The Sequential Order Numbers for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'condition' Post Meta Array Keys in all versions up to, and including, 3.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-104727 Sequential Order Numbers for WooCommerce <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'condition' Post Meta Array Keys

The Sequential Order Numbers for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'condition' Post Meta Array Keys in all versions up to, and including, 3.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-104727

The Sequential Order Numbers for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.6.5 . The root cause is insufficient input sanitization and output escaping within the 'condition' Post Meta Array Keys . This allows authenti...

CVE-2026-104727 Sequential Order Numbers for WooCommerce <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'condition' Post Meta Array Keys

The Sequential Order Numbers for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'condition' Post Meta Array Keys in all versions up to, and including, 3.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

EUVD-2026-112689

The Sequential Order Numbers for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'condition' Post Meta Array Keys in all versions up to, and including, 3.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

WordPress Sequential Order Numbers for WooCommerce cross-site scripting vulnerability

WordPress Sequential Order Numbers for WooCommerce versions 3.6.5 and earlier contain a cross-site scripting vulnerability. This flaw stems from insufficient input sanitization and output escaping. It is easily exploited via the ‘condition’ Post Meta array key, allowing stored cross-site scriptin...

PT-2026-130676

The Sequential Order Numbers for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'condition' Post Meta Array Keys in all versions up to, and including, 3.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-104727: berocket Sequential Order Numbers for WooCommerce: The Sequential Order Numbers for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…

The Sequential Order Numbers for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'condition' Post Meta Array Keys in all versions up to, and including, 3.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

WordPress Sequential Order Numbers for WooCommerce plugin <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Sequential Order Numbers for WooCommerce versions = 3.6.5...

CVE-2026-111354 crmeb_java through 3.1 Authorization Bypass via Front Order Express and Refund Endpoints

crmebjava through 3.1 contains an authorization bypass vulnerability that allows authenticated members to read other members' orders by supplying their order numbers. Attackers can request /api/front/order/express/orderId or /api/front/order/apply/refund/orderId to view victims' tracking numbers,...

CVE-2026-111354

The crmeb_java platform (versions through 3.1) is vulnerable to an authorization bypass (CWE-639) in the order processing logic. This flaw allows authenticated members to access the order details of other members by providing a specific order number. Specifically, attackers can request the /api/f...

CVE-2026-111354: Authorization Bypass Through User-Controlled Key

crmebjava through 3.1 contains an authorization bypass vulnerability that allows authenticated members to read other members' orders by supplying their order numbers. Attackers can request /api/front/order/express/orderId or /api/front/order/apply/refund/orderId to view victims' tracking numbers,...

CVE-2026-82911

Cross-Site Request Forgery CSRF in the OrderConfirmController at GET /order/confirm/ordernumber in Roskus Prospero Flow CRM before 5.15.11 allows an unauthenticated attacker to confirm any order on behalf of an authenticated user by directing them to a crafted page. Laravel's VerifyCsrfToken...

CVE-2026-82911

Cross-Site Request Forgery CSRF in the OrderConfirmController at GET /order/confirm/ordernumber in Roskus Prospero Flow CRM before 5.15.11 allows an unauthenticated attacker to confirm any order on behalf of an authenticated user by directing them to a crafted page. Laravel's VerifyCsrfToken...

CVE-2021-41557

Sofico Miles RIA 2020.2 Build 127964T is affected by Stored Cross Site Scripting XSS. An attacker with access to a user account of the RIA IT or the Fleet role can create a crafted work order in the damage reports section or change existing work orders. The XSS payload is in the work order number...

WordPress Custom Order Numbers for WooCommerce plugin missing authorization vulnerability

The WordPress Custom Order Numbers for WooCommerce plugin is an open source plugin for WooCommerce an e-commerce plugin for WordPress designed to allow users to customize the rules for generating order numbers. WordPress Custom Order Numbers for WooCommerce plugin suffers from a missing...

CVE-2025-66071

Missing Authorization vulnerability in tychesoftwares Custom Order Numbers for WooCommerce custom-order-numbers-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Order Numbers for WooCommerce: from n/a through = 1.11.0...

WordPress Custom Order Numbers for WooCommerce plugin <= 1.11.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin Custom Order Numbers for WooCommerce versions = 1.11.0...

EUVD-2025-198472

Missing Authorization vulnerability in tychesoftwares Custom Order Numbers for WooCommerce custom-order-numbers-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Order Numbers for WooCommerce: from n/a through = 1.11.0...

CVE-2025-66071

CVE-2025-66071 is a Missing Authorization (Broken Access Control) vulnerability in the WordPress plugin Custom Order Numbers for WooCommerce (versions up to and including 1.11.0). The issue allows exploitation due to incorrectly configured access control, with a CVSS v3.1 base score of 5.3 (Mediu...