49 matches found
CVE-2026-107711
The FlexStock – Product Stock Sync with Google Sheets for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'products.postcontent' parameter in all versions up to, and including, 3.17.2 due to insufficient input sanitization and output escaping. This makes it...
EUVD-2026-114695
The FlexStock – Product Stock Sync with Google Sheets for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'products.postcontent' parameter in all versions up to, and including, 3.17.2 due to insufficient input sanitization and output escaping. This makes it...
WordPress FlexStock – Product Stock Sync with Google Sheets for WooCommerce plugin <= 3.17.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability
Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Morato Antoine in WordPress Plugin FlexStock versions = 3.17.2...
PT-2026-134499
Name of the Vulnerable Software and Affected Versions FlexStock – Product Stock Sync with Google Sheets for WooCommerce versions prior to 3.17.3 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level...
CVE-2026-107711: wppool FlexStock – Product Stock Sync with Google Sheets for WooCommerce: The FlexStock – Product Stock Sync with Google Sheets for WooCommerce plugin for WordPress is vulnerable to Stored…
The FlexStock – Product Stock Sync with Google Sheets for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'products.postcontent' parameter in all versions up to, and including, 3.17.2 due to insufficient input sanitization and output escaping. This makes it...
CVE-2026-111660
waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. Attackers can submit predictable orderSn values, built from epoch seconds and a sequential counter, to...
CVE-2026-111660 waynboot-mall through 2.0.0 Missing Authentication via /callback/order/unpaid
waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. Attackers can submit predictable orderSn values, built from epoch seconds and a sequential counter, to...
CVE-2026-111660
The waynboot-mall software (through version 2.0.0 ) is vulnerable to a missing authentication flaw (CWE-306) within the /callback/order/unpaid endpoint. This vulnerability allows unauthenticated attackers to cancel any member's pending orders by submitting predictable orderSn values, which are co...
CVE-2026-111660 waynboot-mall through 2.0.0 Missing Authentication via /callback/order/unpaid
waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. Attackers can submit predictable orderSn values, built from epoch seconds and a sequential counter, to...
CVE-2026-111660
waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. Attackers can submit predictable orderSn values, built from epoch seconds and a sequential counter, to...
EUVD-2026-103082
waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. Attackers can submit predictable orderSn values, built from epoch seconds and a sequential counter, to...
CVE-2026-111660 waynboot-mall through 2.0.0 Missing Authentication via /callback/order/unpaid
waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. Attackers can submit predictable orderSn values, built from epoch seconds and a sequential counter, to...
CVE-2026-111660: Missing Authentication for Critical Function
waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. Attackers can submit predictable orderSn values, built from epoch seconds and a sequential counter, to...
PT-2026-116059
🚨 CVE-2026-111660 waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. Attackers can submit predictable orderSn values, built from epoch seconds and a...
Exploit for CVE-2026-78804
Dolibarr — Authenticated SQL Injection PoC SQL injection affe...
WordPress Mobile App for WooCommerce plugin <= 0.4.69 - Other Vulnerability Type vulnerability
Other Vulnerability Type vulnerability discovered by TruongLV1 From FPT Night Wolf in WordPress Plugin Mobile App for WooCommerce versions = 0.4.69...
CVE-2026-61945
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in MultiVendorX WooCommerce Product Stock Alert allows Retrieve Embedded Sensitive Data. This issue affects WooCommerce Product Stock Alert: from n/a through 3.0.6...
CVE-2026-61945
The CVE-2026-61945 entry concerns the WordPress WooCommerce Product Stock Alert plugin (versions up to 3.0.6) from MultiVendorX. Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability allows retrieval of embedded sensitive data. Affected software: Wo...
EUVD-2026-48249
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in MultiVendorX WooCommerce Product Stock Alert allows Retrieve Embedded Sensitive Data. This issue affects WooCommerce Product Stock Alert: from n/a through 3.0.6...
CVE-2026-61945 WordPress WooCommerce Product Stock Alert plugin <= 3.0.6 - Sensitive Data Exposure vulnerability
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in MultiVendorX WooCommerce Product Stock Alert allows Retrieve Embedded Sensitive Data. This issue affects WooCommerce Product Stock Alert: from n/a through 3.0.6...