CVE-2026-107788

The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when deleting shipping label records, allowing any authenticated user such as a subscriber to delete the shipping label and tracking records of arbitrary orders store-wide...

CVE-2026-107789

The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names, addresses and phone numbers...

CVE-2026-107788 SmartyParcel (WC Ukr Shipping) < 1.23.4 - Subscriber+ Arbitrary Shipping Label Deletion

The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when deleting shipping label records, allowing any authenticated user such as a subscriber to delete the shipping label and tracking records of arbitrary orders store-wide...

EUVD-2026-107062

The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when deleting shipping label records, allowing any authenticated user such as a subscriber to delete the shipping label and tracking records of arbitrary orders store-wide...

CVE-2026-107788

The SmartyParcel (also known as WC Ukr Shipping ) WordPress plugin before version 1.23.4 is vulnerable to an authorization bypass. The plugin fails to perform sufficient authorization checks when deleting shipping label records, which allows any authenticated user , such as a subscriber, to delet...

EUVD-2026-107063

The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names, addresses and phone numbers...

PT-2026-120458

The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names, addresses and phone numbers...

WordPress DHL for WooCommerce plugin < 4.0.1 - Unauthenticated Shipping Label Disclosure via Unprotected Uploads Directory vulnerability

Unauthenticated Shipping Label Disclosure via Unprotected Uploads Directory vulnerability discovered by Artus KG in WordPress Plugin DHL Shipping Germany for WooCommerce versions 4.0.1...

WordPress DHL for WooCommerce plugin < 4.0.1 - Unauthenticated Shipping Label Download via IDOR vulnerability

Unauthenticated Shipping Label Download via IDOR vulnerability discovered by Pedro Pinho, Artus KG in WordPress Plugin DHL Shipping Germany for WooCommerce versions 4.0.1...

CVE-2026-16981

The DHL Shipping Germany for WooCommerce WordPress plugin, in versions prior to 4.0.1 , is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The application fails to perform essential authorization checks—such as capability, nonce, login, or ownership verification—on a specific shipp...

CVE-2026-16981 DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Download via IDOR

The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not perform any authorization check no capability, nonce, login, or ownership check on one of its shipping-label download endpoints, so an unauthenticated attacker can enumerate sequential ids and download every stored...

PT-2026-67990

Name of the Vulnerable Software and Affected Versions DHL Shipping Germany for WooCommerce WordPress plugin versions prior to 4.0.1 Description An issue exists where the shipping-label storage directory is not protected by server-independent access control, relying exclusively on an Apache...

PT-2026-67989

Name of the Vulnerable Software and Affected Versions DHL Shipping Germany for WooCommerce WordPress plugin versions prior to 4.0.1 Description An issue exists where a shipping-label download endpoint does not perform authorization checks, such as capability, nonce, login, or ownership...

CVE-2026-16981: Authorization Bypass Through User-Controlled Key

The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not perform any authorization check no capability, nonce, login, or ownership check on one of its shipping-label download endpoints, so an unauthenticated attacker can enumerate sequential ids and download every stored...

CVE-2026-9235

The DHL eCommerce (Benelux) for WooCommerce WordPress plugin (up to version 2.2.3) is vulnerable to unauthorized modification and data loss due to missing capability checks and missing nonce verification in create_label() and delete_label(). These functions are tied to wp_ajax_dhlpwc_label_create...

EUVD-2024-30620

Malicious code in bioql PyPI...

EUVD-2024-47590

Malicious code in bioql PyPI...

CVE-2024-32834

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WebToffee WooCommerce Shipping Label allows Stored XSS.This issue affects WooCommerce Shipping Label: from n/a through 2.3.8...

CVE-2024-32834

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WebToffee WooCommerce Shipping Label allows Stored XSS.This issue affects WooCommerce Shipping Label: from n/a through 2.3.8...

CVE-2024-32834 WordPress WooCommerce Shipping Label plugin <= 2.3.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WebToffee WooCommerce Shipping Label allows Stored XSS.This issue affects WooCommerce Shipping Label: from n/a through 2.3.8...