Lucene search
+L

295 matches found

Patchstack
Patchstack
added 2026/08/28 1:44 p.m.4 views

WordPress Return Refund and Exchange For WooCommerce plugin < 4.6.4 - Unauthenticated Guest Order Message Disclosure and Manipulation vulnerability

Unauthenticated Guest Order Message Disclosure and Manipulation vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Return Refund and Exchange For WooCommerce versions 4.6.4...

6.5CVSS5.9AI score0.00216EPSS
SaveExploits0References1Affected Software1
Kitploit
Kitploit
added 2026/08/28 10:38 a.m.2 views

CVE-2024-46532

Numero CVE: CVE-2024-46532 fornitore: 上海顶想信息科技有限公司https://www.kancloud.cn/ prodotto: 互联网医疗系统医疗门诊OpenHIS versione: V1.0 componente interessata: https://github.com/1638824607/OpenHIS?tab=readme-ov-file Riproduzione delle vulnerabilità di SQL Injection in OpenHIS Vulnerabilità:...

9.8CVSS5.9AI score0.00968EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/28 8:16 a.m.3 views

CVE-2026-77701

The WCFM Marketplace WordPress plugin before 3.8.2 does not correctly verify that the person requesting a refund owns the order, allowing unauthenticated users to create refund requests against any guest checkout order on the site...

5.3CVSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/28 6:00 a.m.2 views

EUVD-2026-67571

The WCFM Marketplace WordPress plugin before 3.8.2 does not correctly verify that the person requesting a refund owns the order, allowing unauthenticated users to create refund requests against any guest checkout order on the site...

5.3CVSS5.9AI score
SaveExploits0References1
CVE
CVE
added 2026/08/28 6:00 a.m.6 views

CVE-2026-77701

The WCFM Marketplace WordPress plugin before 3.8.2 fails to correctly verify that the requester of a refund owns the order. This allows unauthenticated users to create refund requests against any guest checkout order on the affected site. The root cause is an insufficient authorization check on t...

5.3CVSS5.9AI score
SaveExploits0References1
Patchstack
Patchstack
added 2026/08/28 6:00 a.m.3 views

WordPress WCFM Marketplace plugin < 3.8.2 - Unauthenticated Refund Request Creation on Guest Orders vulnerability

Unauthenticated Refund Request Creation on Guest Orders vulnerability discovered by Shikhali Jamalzade in WordPress Plugin WCFM Marketplace versions 3.8.2...

5.3CVSS5.9AI score
SaveExploits0References1Affected Software1
Cvelist
Cvelist
added 2026/08/28 6:00 a.m.5 views

CVE-2026-77701 WCFM Marketplace < 3.8.2 - Unauthenticated Refund Request Creation on Guest Orders

The WCFM Marketplace WordPress plugin before 3.8.2 does not correctly verify that the person requesting a refund owns the order, allowing unauthenticated users to create refund requests against any guest checkout order on the site...

SaveExploits0References1
Kitploit
Kitploit
added 2026/08/26 9:32 p.m.3 views

CVE-2022-4047

CVE-2022-4047 Return Refund and Exchange For WooCommerce 4.0.9 - Caricamento Arbitrario di File Non Autenticato Utilizzo root@kitploit: @@@@@@@ @@@ @@@ @@@@@@@@ @@@@@@ @@@@@@@@ @@@@@@ @@@@@@ @@@ @@@@@@@@ @@@ @@@@@@@@ @@@@@@@@ @@@ @@@ @@@@@@@@ @@@@@@@@ @@@@@@@@@@ @@@@@@@@ @@@@@@@@ @@@@ @@@@@@@@@@...

9.8CVSS8.7AI score0.06152EPSS
SaveExploits3
NVD
NVD
added 2026/08/26 6:16 a.m.4 views

CVE-2026-77695

The Return Refund and Exchange For WooCommerce WordPress plugin before 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX actions it exposes to unauthenticated users, allowing them to read private order messages, post messages and attachments in the customer's name,...

6.5CVSS0.00216EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/26 6:00 a.m.5 views

EUVD-2026-66285

The Return Refund and Exchange For WooCommerce WordPress plugin before 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX actions it exposes to unauthenticated users, allowing them to read private order messages, post messages and attachments in the customer's name,...

6.5CVSS5.5AI score0.00216EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/08/26 6:00 a.m.6 views

CVE-2026-77695 Woo Refund And Exchange Lite < 4.6.4 - Unauthenticated Guest Order Message Disclosure and Manipulation

The Return Refund and Exchange For WooCommerce WordPress plugin before 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX actions it exposes to unauthenticated users, allowing them to read private order messages, post messages and attachments in the customer's name,...

5.3AI score0.00216EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/26 6:00 a.m.11 views

CVE-2026-77695

CVE-2026-77695 affects the Return Refund and Exchange For WooCommerce WordPress plugin in versions prior to 4.6.4 . The root cause is that certain AJAX actions exposed to unauthenticated users do not correctly verify the ownership of guest orders . An unauthenticated attacker can exploit this to ...

6.5CVSS5.3AI score0.00216EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/26 6:00 a.m.35 views

CVE-2026-77695 Woo Refund And Exchange Lite < 4.6.4 - Unauthenticated Guest Order Message Disclosure and Manipulation

The Return Refund and Exchange For WooCommerce WordPress plugin before 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX actions it exposes to unauthenticated users, allowing them to read private order messages, post messages and attachments in the customer's name,...

0.00216EPSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/08/25 8:26 a.m.2 views

WooRefer

WooRefer | CVE-2022-4047 - Reso, Rimborso e Scambio per WooCommerce Strumento automatico di massa per verificare e sfruttare la vulnerabilità in CVE-2022-4047 - Reso, Rimborso e Scambio per WooCommerce install.sh sha1sum install.sh | grep 12345678 md5sum install.sh...

9.8CVSS8.6AI score0.06152EPSS
SaveExploits3
ATTACKERKB
ATTACKERKB
added 2026/08/09 6:00 a.m.10 views

CVE-2026-18603

The PiWeb Cancel order / Refund request for WooCommerce WordPress plugin before 1.3.4.34 does not have authorization or ownership checks when adding the contents of a previous order to the cart, allowing unauthenticated users to disclose the contents of other customers' orders, as well as to clea...

5.3AI score0.00242EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/01 7:16 a.m.14 views

CVE-2026-13329

The Buckaroo Woocommerce Payments Plugin WordPress plugin before 4.9.0 does not perform any capability check or nonce validation on an AJAX action that processes payment capture refunds, allowing any authenticated user, including Subscribers, to trigger refunds against captured orders...

6.5CVSS0.00174EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/01 6:00 a.m.12 views

EUVD-2026-51699

The Buckaroo Woocommerce Payments Plugin WordPress plugin before 4.9.0 does not perform any capability check or nonce validation on an AJAX action that processes payment capture refunds, allowing any authenticated user, including Subscribers, to trigger refunds against captured orders...

5.5AI score0.00174EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/01 6:00 a.m.42 views

CVE-2026-13329 WC Buckaroo BPE Gateway < 4.9.0 - Subscriber+ Unauthorized Order Refund

The Buckaroo Woocommerce Payments Plugin WordPress plugin before 4.9.0 does not perform any capability check or nonce validation on an AJAX action that processes payment capture refunds, allowing any authenticated user, including Subscribers, to trigger refunds against captured orders...

0.00174EPSS
SaveExploits0References1
NVD
NVD
added 2026/07/13 10:16 a.m.11 views

CVE-2026-57402

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpdesk Flexible Refund and Return Order for WooCommerce flexible-refund-and-return-order-for-woocommerce allows Stored XSS.This issue affects Flexible Refund and Return Order for WooCommerce: from...

6.5CVSS0.00224EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/13 8:41 a.m.35 views

CVE-2026-57402 WordPress Flexible Refund and Return Order for WooCommerce plugin <= 1.0.51 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpdesk Flexible Refund and Return Order for WooCommerce flexible-refund-and-return-order-for-woocommerce allows Stored XSS.This issue affects Flexible Refund and Return Order for WooCommerce: from...

6.5CVSS0.00224EPSS
SaveExploits0References1
Rows per page
Query Builder