WordPress PeproDev WooCommerce Receipt Uploader plugin <= 2.8.0 - Unauthenticated Order Receipt Tampering via IDOR vulnerability

Unauthenticated Order Receipt Tampering via IDOR vulnerability discovered by Lyris Vale in WordPress Plugin PeproDev WooCommerce Receipt Uploader versions = 2.8.0...

DRUPAL-CONTRIB-2026-041

The module doesn't sufficiently sanitize customer comments in the order receipt email template; this could be exploited to achieve Cross-site Scripting XSS. This vulnerability is mitigated by the fact that it only affects installations with Checkout commercecheckout enabled, and the "Comments"...

Commerce Core - Moderately critical - Cross site scripting - SA-CONTRIB-2026-041

The module doesn't sufficiently sanitize customer comments in the order receipt email template; this could be exploited to achieve Cross-site Scripting XSS. This vulnerability is mitigated by the fact that it only affects installations with Checkout commercecheckout enabled, and the "Comments"...