295286 matches found
CVE-2026-110292
The PayPlug for WooCommerce (Official) WordPress plugin, in versions before 3.1.1 , is vulnerable to an unauthenticated order key disclosure and order cancellation. The flaw exists because the plugin fails to verify requester ownership of a WooCommerce order specified in a payment request via the...
CVE-2026-106002
The Court Reservation WordPress plugin, in versions prior to 1.12.4 , is vulnerable to an authentication bypass due to missing authorisation or nonce verification on specific challenge-management actions. This flaw allows unauthenticated users to delete arbitrary tournament-ladder challenge recor...
EUVD-2026-111703
The Court Reservation WordPress plugin before 1.12.4 does not perform any authorisation or nonce verification on one of its challenge-management actions, allowing unauthenticated users to delete arbitrary tournament-ladder challenge records, along with the linked court-booking event when one was...
CVE-2026-105997 Booking Package < 1.7.33 - Unauthenticated Verification Email Sending to Arbitrary Recipient
The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code emails nor bind the recipient to server-side state, allowing unauthenticated users to make the site send templated verification-code emails to arbitrary recipients...
CVE-2026-106002 Court Reservation < 1.12.4 - Unauthenticated Arbitrary Challenge Deletion
The Court Reservation WordPress plugin before 1.12.4 does not perform any authorisation or nonce verification on one of its challenge-management actions, allowing unauthenticated users to delete arbitrary tournament-ladder challenge records, along with the linked court-booking event when one was...
EUVD-2026-111704
The Court Reservation WordPress plugin before 1.12.4 does not perform any authorization, authentication or nonce validation on one of its AJAX actions, allowing unauthenticated users to add or delete reservation types in the Court Reservation WordPress plugin before 1.12.4's configuration...
CVE-2026-104694 Thrive Automator < 11.2 - Editor+ Blind SQLi via 'additional' Parameter
The Thrive Automator WordPress plugin before 11.2 does not properly sanitize and escape a parameter's array key before using it in a SQL query, allowing authenticated attackers with editor-level access to perform blind SQL injection attacks...
CVE-2026-103331
The UniPAY Payment Gateway For WooCommerce WordPress plugin (versions before 2.4 ) is vulnerable to an unauthenticated order payment forgery due to improper verification of payment notifications. The root cause is that notification signatures are validated against a merchant secret that is empty ...
CVE-2026-103331 UniPAY Payment Gateway For WooCommerce < 2.4 - Unauthenticated Order Payment Forgery via Empty IPN Secret
The UniPAY Payment Gateway For WooCommerce WordPress plugin before 2.4 does not properly verify the authenticity of payment notifications, as their signature is checked against a merchant secret that is empty by default, allowing unauthenticated attackers to forge a valid notification and mark...
EUVD-2026-111595
The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.2 via the processcheckout function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the serve...
CLSA-2026-1793162375 TuxCare security update for @babel/plugin-proposal-pipeline-operator (2 CVEs)
TuxCare rebuilt @babel/plugin-proposal-pipeline-operator to address 2 CVEs. Fixed in 7.16.7-tuxcare.2...
CLSA-2026-1793162374 TuxCare security update for @babel/plugin-proposal-pipeline-operator (1 CVE)
TuxCare rebuilt @babel/plugin-proposal-pipeline-operator to address 1 CVE. Fixed in 7.14.8-tuxcare.2...
CLSA-2026-1793162376 TuxCare security update for @babel/plugin-proposal-pipeline-operator (1 CVE)
TuxCare rebuilt @babel/plugin-proposal-pipeline-operator to address 1 CVE. Fixed in 7.16.7-tuxcare.3...
CLSA-2026-1793162373 TuxCare security update for @babel/plugin-proposal-pipeline-operator (1 CVE)
TuxCare rebuilt @babel/plugin-proposal-pipeline-operator to address 1 CVE. Fixed in 7.25.7-tuxcare.2...
CLSA-2026-1793162371 TuxCare security update for @babel/plugin-proposal-pipeline-operator (1 CVE)
TuxCare rebuilt @babel/plugin-proposal-pipeline-operator to address 1 CVE. Fixed in 7.21.0-tuxcare.4...
CLSA-2026-1793162372 TuxCare security update for @babel/plugin-proposal-pipeline-operator (1 CVE)
TuxCare rebuilt @babel/plugin-proposal-pipeline-operator to address 1 CVE. Fixed in 7.12.18-tuxcare.3...
CLSA-2026-1793162368 TuxCare security update for @babel/plugin-proposal-pipeline-operator (1 CVE)
TuxCare rebuilt @babel/plugin-proposal-pipeline-operator to address 1 CVE. Fixed in 7.29.0-tuxcare.2...
CLSA-2026-1793162370 TuxCare security update for @babel/plugin-proposal-pipeline-operator (2 CVEs)
TuxCare rebuilt @babel/plugin-proposal-pipeline-operator to address 2 CVEs. Fixed in 7.21.5-tuxcare.2...