CVE-2026-104801

The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the renamefiles function in all versions up to, and including, 34.0.10 This makes it possible for unauthenticated attackers to delete...

CVE-2026-104801 PPOM <= 34.0.10 - Unauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' Parameter

The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the renamefiles function in all versions up to, and including, 34.0.10 This makes it possible for unauthenticated attackers to delete...

EUVD-2026-96218

The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the renamefiles function in all versions up to, and including, 34.0.10 This makes it possible for unauthenticated attackers to delete...

CVE-2026-104801

The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to unauthenticated arbitrary file deletion in all versions up to and including 34.0.10 . The root cause is insufficient file path validation within the rename_files function, specifically triggered via th...

PT-2026-109552

Name of the Vulnerable Software and Affected Versions PPOM – Product Addons & Custom Fields for WooCommerce versions prior to 34.0.11 Description Insufficient file path validation in the rename files function allows unauthenticated attackers to delete arbitrary files on the server. This action ca...

WordPress PPOM – Product Addons & Custom Fields for WooCommerce plugin <= 34.0.10 - Unauthenticated Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion vulnerability discovered by whatm in WordPress Plugin PPOM for WooCommerce versions = 34.0.10...

CVE-2026-1984

The Ibtana – Ecommerce Product Addons plugin for WordPress is vulnerable to unauthorized post meta modification due to a missing capability check on the 'iepausegteditor' AJAX action in all versions up to, and including, 0.4.7.7. This makes it possible for authenticated attackers, with...

CVE-2026-1984 Ibtana – Ecommerce Product Addons <= 0.4.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'iepa_use_gt_editor' AJAX Action

The Ibtana – Ecommerce Product Addons plugin for WordPress is vulnerable to unauthorized post meta modification due to a missing capability check on the 'iepausegteditor' AJAX action in all versions up to, and including, 0.4.7.7. This makes it possible for authenticated attackers, with...

CVE-2026-1984 Ibtana – Ecommerce Product Addons <= 0.4.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'iepa_use_gt_editor' AJAX Action

The Ibtana – Ecommerce Product Addons plugin for WordPress is vulnerable to unauthorized post meta modification due to a missing capability check on the 'iepausegteditor' AJAX action in all versions up to, and including, 0.4.7.7. This makes it possible for authenticated attackers, with...

PT-2026-95784

Name of the Vulnerable Software and Affected Versions Ibtana – Ecommerce Product Addons versions prior to 0.4.7.8 Description Authenticated users with Subscriber-level access and above can perform unauthorized post meta modification. This is caused by a missing capability check on the 'iepa use g...

CVE-2026-1984: Missing Authorization

The Ibtana – Ecommerce Product Addons plugin for WordPress is vulnerable to unauthorized post meta modification due to a missing capability check on the 'iepausegteditor' AJAX action in all versions up to, and including, 0.4.7.7. This makes it possible for authenticated attackers, with...

CVE-2026-2996 Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.21 - Unauthenticated Improper Input Validation to Price Bypass via Add-to-Cart POST Request

The Advanced Product Fields Product Addons for WooCommerce plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 1.6.21. This is due to a logic flaw in the 'validatecartdata' function. This makes it possible for unauthenticated attackers to bypass...

CVE-2026-2996: Improper Input Validation

The Advanced Product Fields Product Addons for WooCommerce plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 1.6.21. This is due to a logic flaw in the 'validatecartdata' function. This makes it possible for unauthenticated attackers to bypass...

CVE-2026-12968 Product Addons – WowAddons < 1.6.15 - Unauthenticated Stored XSS via Arbitrary SVG Upload

The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not restrict an unauthenticated file-upload endpoint and accepts SVG files that are stored and served inline, allowing an unauthenticated attacker to upload a malicious SVG whose embedded script executes...

CVE-2026-12968 Product Addons – WowAddons < 1.6.15 - Unauthenticated Stored XSS via Arbitrary SVG Upload

The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not restrict an unauthenticated file-upload endpoint and accepts SVG files that are stored and served inline, allowing an unauthenticated attacker to upload a malicious SVG whose embedded script executes...

CVE-2026-12968

The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not restrict an unauthenticated file-upload endpoint and accepts SVG files that are stored and served inline, allowing an unauthenticated attacker to upload a malicious SVG whose embedded script executes...

CVE-2026-12968

The Product Addons and Product Options With Custom Fields WordPress plugin (referred to as WowAddons ) versions before 1.6.15 is vulnerable to unauthenticated stored XSS . The root cause is an unrestricted file-upload endpoint that accepts SVG files , which are subsequently stored and served inli...

CVE-2026-12968: Improper Neutralization of Input During Web Page Generation

The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not restrict an unauthenticated file-upload endpoint and accepts SVG files that are stored and served inline, allowing an unauthenticated attacker to upload a malicious SVG whose embedded script executes...

CVE-2026-57377

CVE-2026-57377 describes a missing authorization vulnerability in the WordPress WowAddons plugin (product-addons) affecting versions up to 1.6.8. The underlying issue is broken access control, i.e., incorrectly configured access control security levels, which can allow unauthorized actions. The v...

CVE-2026-57377 WordPress WowAddons plugin <= 1.6.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in WPXPO WowAddons product-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WowAddons: from n/a through = 1.6.8...