Ubigeo de Peru < 3.6.4 - SQL Injection

The plugin does not properly sanitise and escape some parameters before using them in SQL statements via various AJAX actions, some of which are available to unauthenticated users, leading to SQL Injections. id: CVE-2022-0814 info: name: Ubigeo de Peru 3.6.4 - SQL Injection author: r3Y3r53...

CVE-2026-3891

CVE-2026-3891 — Pix for WooCommerce Unauthenticated File Upload RCE Nonce Leak → certificatecrtpath Upload → Code Execution Overview CVE-2026-3891 is a critical-severity CVSS 9.8 unauthenticated arbitrary file upload vulnerability in the Pix for WooCommerce WordPress plugin by linknacional versio...

CVE-2026-76058

The PayPal Brasil para WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to disab...

CVE-2026-76058 PayPal Brasil para WooCommerce <= 1.7.8 - Missing Authorization to Unauthenticated Payment Gateway Modification via 'bcdc_activation_update' Action

The PayPal Brasil para WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to disab...

EUVD-2026-111742

The PayPal Brasil para WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to disab...

CVE-2026-76058 PayPal Brasil para WooCommerce <= 1.7.8 - Missing Authorization to Unauthenticated Payment Gateway Modification via 'bcdc_activation_update' Action

The PayPal Brasil para WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to disab...

CVE-2026-76058

The PayPal Brasil para WooCommerce plugin for WordPress (versions up to and including 1.7.8 ) is vulnerable to an authorization bypass (CWE-862). The flaw occurs because the plugin fails to properly verify user permissions when performing specific actions, specifically the 'bcdc_activation_update...

CVE-2026-76058: odefranca PayPal Brasil para WooCommerce: The PayPal Brasil para WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to,…

The PayPal Brasil para WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to disab...

PT-2026-127890

The PayPal Brasil para WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to disab...

WordPress PayPal Brasil para WooCommerce plugin <= 1.7.8 - Missing Authorization to Unauthenticated Payment Gateway Modification vulnerability

Missing Authorization to Unauthenticated Payment Gateway Modification vulnerability discovered by Wordfence PRISM in WordPress Plugin PayPal Brasil para WooCommerce versions = 1.7.8...

WordPress TiendaCrypto para WooCommerce plugin 1.0.1-1.2.1 - Unauthenticated Order Payment Forgery vulnerability

Unauthenticated Order Payment Forgery vulnerability discovered by Naoki Kawahigashi in WordPress Plugin TiendaCrypto para WooCommerce versions 1.0.1-1.2.1...

CVE-2026-103325

The TiendaCrypto para WooCommerce WordPress plugin through 1.2.1 does not correctly verify the authenticity of its payment webhook, validating the request signature against a key that is always empty, which allows unauthenticated attackers to forge webhook notifications and mark arbitrary...

CVE-2026-103325 TiendaCrypto para WooCommerce 1.0.1 - 1.2.1 - Unauthenticated Order Payment Forgery via Webhook HMAC Bypass

The TiendaCrypto para WooCommerce WordPress plugin through 1.2.1 does not correctly verify the authenticity of its payment webhook, validating the request signature against a key that is always empty, which allows unauthenticated attackers to forge webhook notifications and mark arbitrary...

CVE-2026-103325 TiendaCrypto para WooCommerce 1.0.1 - 1.2.1 - Unauthenticated Order Payment Forgery via Webhook HMAC Bypass

The TiendaCrypto para WooCommerce WordPress plugin through 1.2.1 does not correctly verify the authenticity of its payment webhook, validating the request signature against a key that is always empty, which allows unauthenticated attackers to forge webhook notifications and mark arbitrary...

CVE-2026-103325

The TiendaCrypto para WooCommerce WordPress plugin (versions through 1.2.1 ) contains a vulnerability where it fails to correctly verify the authenticity of its payment webhooks. The root cause is that the plugin validates the request signature against a key that is consistently empty . This flaw...

EUVD-2026-110632

The TiendaCrypto para WooCommerce WordPress plugin through 1.2.1 does not correctly verify the authenticity of its payment webhook, validating the request signature against a key that is always empty, which allows unauthenticated attackers to forge webhook notifications and mark arbitrary...

PT-2026-125879

Name of the Vulnerable Software and Affected Versions TiendaCrypto para WooCommerce versions 1.0.1 through 1.2.1 Description The plugin fails to correctly verify the authenticity of its payment webhook. It validates the request signature against a key that is always empty, allowing unauthenticate...

com.erudika:para-server (>=1.25.0, <=1.25.2), com.erudika:para-war (>=1.25.0, <=1.25.2) +18 more potentially affected by CVE-2026-107726 via com.hazelcast:hazelcast (3.8.3)

com.hazelcast:hazelcast MAVEN version 3.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.erudika:para-server =1.25.0, =1.25.0, =0.14.0, =0.18.2 -...

com.consol.citrus:citrus-vertx (2.2), com.erudika:para (>=1.5.1, <=1.8.0) +51 more potentially affected by CVE-2026-107726 via com.hazelcast:hazelcast (3.2.3)

com.hazelcast:hazelcast MAVEN version 3.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.consol.citrus:citrus-vertx 2.2 - com.erudika:para =1.5.1, =1.2.1, =1.4.4 -...

CVE-2026-42714

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Piggly Dev Pix por Piggly para Woocommerce pix-por-piggly allows Blind SQL Injection.This issue affects Pix por Piggly para Woocommerce: from n/a through 2.1.2...