WordPress Salon Booking System - Free Version plugin < 10.30.34 - Unauthenticated Arbitrary Booking Total Tampering vulnerability

WordPress Salon Booking System - Free Version plugin 10.30.34 - Unauthenticated Arbitrary Booking Total Tampering vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Salon booking system versions 10.30.34...

MAL-2026-14272 Malicious code in price-scripping-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52b5a1792ab4822af305a8d853e858a8063d9e82e5d91d3dbd3a748300aaf7f9 [email protected] runs node dist/postinstall.js as its npm postinstall script. That entry point resolves the installing project's root via...

WordPress Pinpoint Booking System plugin <= 2.9.9.6.8 - Unauthenticated Improper Input Validation to Price Manipulation via 'cart_data' Parameter vulnerability

Unauthenticated Improper Input Validation to Price Manipulation via 'cartdata' Parameter vulnerability discovered by WordFence in WordPress Plugin Pinpoint Booking System versions = 2.9.9.6.8...

CVE-2026-12128

The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to Price Manipulation via the cartdata parameter in all versions up to, and including, 2.9.9.6.8. This is due to the dopbspwoocommerceaddtocart AJAX action being registered via wpajaxnopriv with no authentication, no nonce...

CVE-2026-12128

CVE-2026-12128 affects Pinpoint Booking System – Version 2 for WordPress. The vulnerability allows unauthenticated attackers to manipulate checkout prices for any bookable product linked to a booking calendar by exploiting the WooCommerce price handling flow: the dopbsp_woocommerce_add_to_cart AJ...

EUVD-2026-58843

The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to Price Manipulation via the cartdata parameter in all versions up to, and including, 2.9.9.6.8. This is due to the dopbspwoocommerceaddtocart AJAX action being registered via wpajaxnopriv with no authentication, no nonce...

CVE-2026-12128

The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to Price Manipulation via the cartdata parameter in all versions up to, and including, 2.9.9.6.8. This is due to the dopbspwoocommerceaddtocart AJAX action being registered via wpajaxnopriv with no authentication, no nonce...

CVE-2026-12128 Pinpoint Booking System <= 2.9.9.6.8 - Unauthenticated Improper Input Validation to Price Manipulation via 'cart_data' Parameter

The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to Price Manipulation via the cartdata parameter in all versions up to, and including, 2.9.9.6.8. This is due to the dopbspwoocommerceaddtocart AJAX action being registered via wpajaxnopriv with no authentication, no nonce...

WordPress Payment Button for PayPal plugin <= 1.2.3.44 - Unauthenticated Payment Price Manipulation vulnerability

Unauthenticated Payment Price Manipulation vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Payment Button for PayPal versions = 1.2.3.44...

WordPress Wallet System for WooCommerce plugin < 2.7.10 - Customer+ Checkout Price Manipulation via Unvalidated Wallet Amount vulnerability

Customer+ Checkout Price Manipulation via Unvalidated Wallet Amount vulnerability discovered by takuma in WordPress Plugin Wallet System for WooCommerce versions 2.7.10...

CVE-2026-16990

The Payment Button for PayPal WordPress plugin through 1.2.3.44 does not enforce the merchant-configured price server-side and trusts a client-supplied payment amount, allowing unauthenticated attackers to create a real PayPal order against the merchant for an arbitrary lower amount...

CVE-2026-17008

The CVE-2026-17008 entry concerns the Quick PayPal Payments WordPress plugin (versions up to 5.7.50). The PayPal IPN handler does not verify the paid amount, receiver, or payment status; it marks an order as paid based solely on an order-token match. As a result, a buyer could pay an arbitrary sm...

CVE-2026-17008

The Quick Paypal Payments WordPress plugin through 5.7.50 does not verify the paid amount, receiver, or payment status in its PayPal IPN handler and marks an order paid on an order-token match alone, so a buyer who pays an arbitrary small amount can have a full-price order marked paid...

CVE-2026-16990 Payment Button for PayPal <= 1.2.3.44 - Unauthenticated Payment Price Manipulation

The Payment Button for PayPal WordPress plugin through 1.2.3.44 does not enforce the merchant-configured price server-side and trusts a client-supplied payment amount, allowing unauthenticated attackers to create a real PayPal order against the merchant for an arbitrary lower amount...

CVE-2026-16990

The Payment Button for PayPal WordPress plugin through 1.2.3.44 does not enforce the merchant-configured price server-side and trusts a client-supplied payment amount, allowing unauthenticated attackers to create a real PayPal order against the merchant for an arbitrary lower amount...

EUVD-2026-57175

The Payment Button for PayPal WordPress plugin through 1.2.3.44 does not enforce the merchant-configured price server-side and trusts a client-supplied payment amount, allowing unauthenticated attackers to create a real PayPal order against the merchant for an arbitrary lower amount...

CVE-2026-16990

The CVE concerns the WordPress plugin “Payment Button for PayPal” (versions up to 1.2.3.44). The root cause is that the plugin does not enforce the merchant-configured price server-side and trusts the amount provided by the client, enabling unauthenticated attackers to create a real PayPal order ...

CVE-2026-15045

The Wallet System for WooCommerce WordPress plugin before 2.7.10 does not validate a user-supplied wallet amount against the customer's actual stored balance during checkout, allowing authenticated customers to arbitrarily reduce their own order total, including down to zero, and complete checkou...

CVE-2026-15045

The Wallet System for WooCommerce WordPress plugin (before 2.7.10) does not validate a user-supplied wallet amount against the user’s stored balance during checkout, allowing authenticated users to arbitrarily reduce their order total (even to zero) and complete checkout without paying. A fix is ...

CVE-2026-15045 Wallet System for WooCommerce < 2.7.10 - Customer+ Checkout Price Manipulation via Unvalidated Wallet Amount

The Wallet System for WooCommerce WordPress plugin before 2.7.10 does not validate a user-supplied wallet amount against the customer's actual stored balance during checkout, allowing authenticated customers to arbitrarily reduce their own order total, including down to zero, and complete checkou...