9975 matches found
EUVD-2026-58597
The Epeken All Kurir for Woocommerce WordPress plugin through 2.1.2 does not verify that a payment-confirmation request originates from the owner of the targeted order, nor that any payment actually occurred, allowing unauthenticated attackers to mark arbitrary orders as confirmed and, in a...
CVE-2026-66700
Unauthenticated Cross Site Scripting XSS in Smart Online Order for Clover = 1.6.1 versions...
CVE-2026-66424
Unauthenticated Privilege Escalation in SMS Alert Order Notifications = 3.9.7 versions...
CVE-2026-66700
Unauthenticated Cross Site Scripting XSS in Smart Online Order for Clover = 1.6.1 versions...
CVE-2026-66700 WordPress Smart Online Order for Clover plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Smart Online Order for Clover = 1.6.1 versions...
CVE-2026-66700
CVE-2026-66700 affects the WordPress plugin “Smart Online Order for Clover” (versions <= 1.6.1). The vulnerability is an Unauthenticated Cross Site Scripting (XSS) flaw reported for that plugin, indicating an attacker can inject scripts without authentication. Connected records confirm the aff...
EUVD-2026-57906
Unauthenticated Cross Site Scripting XSS in Smart Online Order for Clover = 1.6.1 versions...
CVE-2026-66424 WordPress SMS Alert Order Notifications plugin <= 3.9.7 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in SMS Alert Order Notifications = 3.9.7 versions...
CVE-2026-66424
CVE-2026-66424 affects the WordPress plugin SMS Alert Order Notifications (versions
CVE-2026-66424
Unauthenticated Privilege Escalation in SMS Alert Order Notifications = 3.9.7 versions...
EUVD-2026-57860
Unauthenticated Privilege Escalation in SMS Alert Order Notifications = 3.9.7 versions...
WordPress Eventin plugin < 4.1.20 - Contributor+ Order Information Disclosure via IDOR vulnerability
Contributor+ Order Information Disclosure via IDOR vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin WP Event SOlution versions 4.1.20...
CVE-2026-18945
The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX actions, allowing unauthenticated users to view other customers' order details, including personal information, as well as change t...
CVE-2026-18945
The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX actions, allowing unauthenticated users to view other customers' order details, including personal information, as well as change t...
CVE-2026-18945
CVE-2026-18945 concerns the WP Helper Premium WordPress plugin (before 4.7.6). The root cause is missing verification of the order key when rendering the custom order confirmation page and handling related AJAX actions, which allows unauthenticated users to view other customers’ order details (in...
CVE-2026-18945 WP Helper Premium < 4.7.6 - Unauthenticated Order Data Disclosure and Order Manipulation via Missing Order Key Validation
The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX actions, allowing unauthenticated users to view other customers' order details, including personal information, as well as change t...
EUVD-2026-57728
The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX actions, allowing unauthenticated users to view other customers' order details, including personal information, as well as change t...
PT-2026-71593
Unauthenticated Cross Site Scripting XSS in Smart Online Order for Clover = 1.6.1 versions...
CVE-2026-72807
SiYuan versions before v3.7.4 contain a second-order SQL injection vulnerability in attribute-view template columns that expose the queryBlocks function, which executes raw SQL using string substitution instead of parameterized queries. Attackers can distribute malicious SiYuan documents or...
CVE-2026-72807 SiYuan before v3.7.4 SQL Injection via queryBlocks template
SiYuan versions before v3.7.4 contain a second-order SQL injection vulnerability in attribute-view template columns that expose the queryBlocks function, which executes raw SQL using string substitution instead of parameterized queries. Attackers can distribute malicious SiYuan documents or...