CVE-2026-108724 Sylius through 2.3.0 Authorization Bypass via Shop API Product-Review Endpoint

Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmoderated and rejected product reviews because the AcceptedExtension filter is not applied to the item operation. Attackers can enumerate sequential ids on GET...

CVE-2026-108724

Versions of Sylius through 2.3.0 are vulnerable to an authorization bypass in the Shop API. The issue stems from the AcceptedExtension filter not being applied to the item operation, allowing unauthenticated attackers to bypass merchant moderation. By enumerating sequential IDs on the GET /api/v2...

EUVD-2026-96890

Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmoderated and rejected product reviews because the AcceptedExtension filter is not applied to the item operation. Attackers can enumerate sequential ids on GET...

CVE-2024-50945

CVE-2024-50945 Descrizione SimplCommerce è affetto da una vulnerabilità di controllo degli accessi non corretti nel sistema di recensioni, che consente a utenti non autorizzati di pubblicare recensioni per prodotti che non hanno acquistato. Metodo di rilevamento Un attaccante può rilevare questa...

CVE-2026-102362: Missing Authentication for Critical Function

mall4j through 4.0 fails to implement authentication controls on the DELETE /prodComm endpoint in ProdCommController. Unauthenticated attackers can delete arbitrary product reviews by supplying the prodCommId parameter without authorization checks...

CVE-2026-102362 mall4j through 4.0 Missing Authentication in Product Review Deletion

mall4j through 4.0 fails to implement authentication controls on the DELETE /prodComm endpoint in ProdCommController. Unauthenticated attackers can delete arbitrary product reviews by supplying the prodCommId parameter without authorization checks...

CVE-2026-102362 mall4j through 4.0 Missing Authentication in Product Review Deletion

mall4j through 4.0 fails to implement authentication controls on the DELETE /prodComm endpoint in ProdCommController. Unauthenticated attackers can delete arbitrary product reviews by supplying the prodCommId parameter without authorization checks...

CVE-2026-102362 mall4j through 4.0 Missing Authentication in Product Review Deletion

mall4j through 4.0 fails to implement authentication controls on the DELETE /prodComm endpoint in ProdCommController. Unauthenticated attackers can delete arbitrary product reviews by supplying the prodCommId parameter without authorization checks...

PT-2026-102405

Name of the Vulnerable Software and Affected Versions mall4j versions prior to 4.1 Description The software fails to implement authentication controls on the 'DELETE /prodComm' endpoint within the ProdCommController. This allows unauthenticated attackers to delete arbitrary product reviews by...

CVE-2026-49223

Vvveb CMS (versions before 1.0.8.4) has an authorization bypass in admin/sql/sqlite/product_review.sql, which accepts a caller-controlled product_review_id without verifying ownership against the current admin's admin_id. A low-privileged Vendor can read, edit, approve, or delete reviews under an...

CVE-2026-49223

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product review operations allow a low-privileged Vendor to manage reviews under another Vendor's products. The admin/sql/sqlite/productreview.sql queries accept ...

CVE-2026-16041 MStore API < 4.21.0 - Unauthenticated Product Review Creation

The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create WooCommerce product reviews with an attacker-chosen reviewer name, email and star rating on stores...

CVE-2026-16041

The MStore API WordPress plugin, in versions prior to 4.21.0 , is vulnerable to an authorization bypass. The plugin fails to perform necessary authorization or purchase-ownership checks on its REST product-review creation route . This flaw allows an unauthenticated attacker to create fake WooComm...

CVE-2026-8499: Access of Resource Using Incompatible Type

The Helpfulcrowd Product Reviews plugin for WordPress is vulnerable to Authorization Bypass via PHP Type Juggling in versions up to, and including, 1.2.9. This is due to the helpfulcrowdvalidatetoken function using a loose comparison operator != instead of a strict comparison !== when validating...

WordPress Helpfulcrowd Product Reviews plugin <= 1.2.9 - Inccorect Authorization vulnerability

Inccorect Authorization vulnerability discovered by Legion Hunter in WordPress Plugin Helpfulcrowd Product Reviews versions = 1.2.9...

CVE-2025-10679

The ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More WordPress plugin (up to v2.2.12) is vulnerable due to insufficient input validation in the bulkTenReviews function, allowing user-controlled data to be passed to a variable function call ...

CVE-2025-10736: Improper Authorization

The ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress is vulnerable to unauthorized access of data due to improper authorization checks on the userAccessibility function in all versions up to, and including, 2.2.10. This...

CVE-2025-10734: Insecure Storage of Sensitive Information

The ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.12 via the syncedData function. This makes it possible for unauthenticated...

CVE-2025-10731: Improper Authorization

The ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.12 via the allReminderSettings function. This makes it possible for...

CVE-2025-10679: Improper Control of Generation of Code

The ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress is vulnerable to arbitrary method calls in all versions up to, and including, 2.2.12. This is due to insufficient input validation in the bulkTenReviews function that...