CVE-2026-17581

The WCPOS – Point of Sale POS plugin for WooCommerce plugin for WordPress is vulnerable to Code Injection via the 'thermal' Template Engine in all versions up to, and including, 1.9.14 due to the ReceiptRendererFactory dispatching templates with the 'thermal' engine to the LegacyPhpRenderer inste...

CVE-2026-70560

Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...

CVE-2026-70560

CVE-2026-70560 affects Ultimate POS (Stock Management & Point of Sale). A stored XSS vulnerability allows low-privileged authenticated users to inject arbitrary HTML/script by submitting a malicious payload in the user first-name field during account creation. When such a user with a low-privileg...

CVE-2026-70560 Ultimate POS Stored XSS via First Name Field in Leave Notifications

Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...

CVE-2026-70560

Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...

EUVD-2026-57170

Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...

CVE-2026-19426

POS System developed by FitSoft has a Missing Authentication vulnerability. Unauthenticated remote attackers can directly access and operate the system...

CVE-2026-19426

The CVE concerns a POS System by FitSoft with a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access and operate the system. Affected details from connected sources confirm the issue exists and yields high impact: CVSS v3.1 base score 8.2 (Network, LOW attack ...

EUVD-2026-57148

POS System developed by FitSoft has a Missing Authentication vulnerability. Unauthenticated remote attackers can directly access and operate the system...

CVE-2026-19426

POS System developed by FitSoft has a Missing Authentication vulnerability. Unauthenticated remote attackers can directly access and operate the system...

CVE-2026-19426 FitSoft｜POS Sytstem - Missing Authentication

POS System developed by FitSoft has a Missing Authentication vulnerability. Unauthenticated remote attackers can directly access and operate the system...

PT-2026-71035

POS System developed by FitSoft has a Missing Authentication vulnerability. Unauthenticated remote attackers can directly access and operate the system...

PT-2026-71057

Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...

CVE-2026-14328

The CVE-2026-14328 entry describes a Privilege Escalation in the Eazy Plugin Manager for WordPress (up to version 4.4.1). The root cause is insufficient authorization on the wp_ajax_pos_get_option AJAX handler, which returns arbitrary WordPress options via get_option() after only a localized nonc...

CVE-2026-16078

CVE-2026-16078 affects the WCPOS

CVE-2026-57688

Unauthenticated Broken Access Control in POS Entegratör = 3.7.103 versions...

CVE-2026-57688

The CVE concerns the WordPress POS Entegratör plugin (versions

CVE-2026-57688 WordPress POS Entegratör plugin <= 3.7.103 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in POS Entegratör = 3.7.103 versions...

EUVD-2026-41297

Unauthenticated Broken Access Control in POS Entegratör = 3.7.103 versions...

WordPress POS Entegratör plugin <= 3.7.103 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by hivesec in WordPress Plugin POS Entegratör versions = 3.7.103...