CVE-2026-15230

CVE-2026-15230 affects the WordPress plugin YayPricing prior to 3.5.7. The vulnerability arises because several REST API routes do not perform proper capability checks and rely on a shared nonce, allowing any authenticated user (e.g., a subscriber) to modify pricing configuration and disclose pri...

EUVD-2026-53116

The YayPricing WordPress plugin before 3.5.7 does not perform capability checks on several of its REST API routes, relying only on a shared nonce, allowing any authenticated user such as a subscriber to overwrite the store's pricing configuration and to disclose private coupon codes...

CVE-2026-13725

The Dynamic Pricing With Discount Rules for WooCommerce WordPress plugin before 5.0.0 does not validate a nonce or user capabilities on one of its AJAX actions and reflects unsanitised user input in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against...

EUVD-2026-51702

The Dynamic Pricing With Discount Rules for WooCommerce WordPress plugin before 5.0.0 does not validate a nonce or user capabilities on one of its AJAX actions and reflects unsanitised user input in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against...

CVE-2026-13725 Dynamic Pricing With Discount Rules for WooCommerce < 5.0.0 - Reflected XSS via wdpAjax

The Dynamic Pricing With Discount Rules for WooCommerce WordPress plugin before 5.0.0 does not validate a nonce or user capabilities on one of its AJAX actions and reflects unsanitised user input in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against...

CVE-2026-13725

The CVE concerns the WordPress plugin “Dynamic Pricing With Discount Rules for WooCommerce” (pre-5.0.0). It reports that an AJAX action does not validate a nonce or user capabilities and returns unsanitised input, enabling unauthenticated attackers to perform a Reflected Cross-Site Scripting (XSS...

CVE-2026-13725

The Dynamic Pricing With Discount Rules for WooCommerce WordPress plugin before 5.0.0 does not validate a nonce or user capabilities on one of its AJAX actions and reflects unsanitised user input in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against...

CVE-2026-13344

The Essential Addons for Elementor WordPress plugin before 6.6.10 does not validate the HTML tag name of the Pricing Table widget title before outputting it, allowing users with Contributor-level access and above to inject JavaScript that will be executed Stored Cross-Site Scripting when the page...

CVE-2026-14207

The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it, allowing users with a course-editing role to inject JavaScript that executes in the session of an administrator who views the course...

CVE-2026-13344

The CVE concerns the Essential Addons for Elementor WordPress plugin: versions before 6.6.10 are vulnerable. The bug is in the Pricing Table widget title; the HTML tag name is not validated before output, enabling Stored XSS via the title for users with Contributor-level access and above. When an...

CVE-2026-13344

The Essential Addons for Elementor WordPress plugin before 6.6.10 does not validate the HTML tag name of the Pricing Table widget title before outputting it, allowing users with Contributor-level access and above to inject JavaScript that will be executed Stored Cross-Site Scripting when the page...

CVE-2026-13344 Essential Addons for Elementor - Lite < 6.6.10 - Contributor+ Stored XSS via Pricing Table Title Tag

The Essential Addons for Elementor WordPress plugin before 6.6.10 does not validate the HTML tag name of the Pricing Table widget title before outputting it, allowing users with Contributor-level access and above to inject JavaScript that will be executed Stored Cross-Site Scripting when the page...

EUVD-2026-51011

The Essential Addons for Elementor WordPress plugin before 6.6.10 does not validate the HTML tag name of the Pricing Table widget title before outputting it, allowing users with Contributor-level access and above to inject JavaScript that will be executed Stored Cross-Site Scripting when the page...

EUVD-2026-50993

The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it, allowing users with a course-editing role to inject JavaScript that executes in the session of an administrator who views the course...

CVE-2026-14207 LifterLMS < 10.0.10 - Instructor+ Stored XSS via Featured Pricing Information

The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it, allowing users with a course-editing role to inject JavaScript that executes in the session of an administrator who views the course...

CVE-2026-14207

CVE-2026-14207 affects the LifterLMS WordPress plugin prior to 10.0.10. The root cause is that event-handler attributes in a course pricing field are not stripped before storage/rendering, allowing users with a course-editing role to inject JavaScript that executes in an administrator’s session w...

CVE-2026-59556

Unauthenticated Cross Site Scripting XSS in Dynamic Pricing With Discount Rules for WooCommerce = 4.5.11 versions...

CVE-2026-59556

Unauthenticated Cross Site Scripting XSS in Dynamic Pricing With Discount Rules for WooCommerce = 4.5.11 versions...

CVE-2026-59556

CVE-2026-59556 : Unauthenticated Cross Site Scripting (XSS) in the WordPress plugin Dynamic Pricing With Discount Rules for WooCommerce (versions

WordPress Dynamic Pricing With Discount Rules for WooCommerce plugin <= 4.5.11 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Denny Abraham Sinaga in WordPress Plugin Dynamic Pricing With Discount Rules for WooCommerce versions = 4.5.11...