550 matches found
EUVD-2026-118171
The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 8.0.26. This is due to insufficient sanitization of the feedConfigCustom2 parameter — only wpunslash is...
CVE-2026-87964
The Product Feed Manager for WooCommerce – CTX Feed WordPress plugin (versions
WordPress Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels plugin <= 8.0.26 - Authenticated (Shop Manager+) PHP Code Injection vulnerability
Authenticated Shop Manager+ PHP Code Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin CTX Feed versions = 8.0.26...
CVE-2026-120558
The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the trackingprovider parameter of the POST /wp-json/wc-ast/v3/orders//shipment-trackings REST endpoint in all versions up to, and including, 3.9. This is due to insufficient escaping on the...
CVE-2026-120563
The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 5.5.7. This is due to insufficient input validation on the currency exchange rate parameter in the savecurrency AJAX handler, which lacks capability...
CVE-2026-120563 WPML Multilingual & Multicurrency for WooCommerce <= 5.5.7 - Authenticated (Shop Manager+) SQL Injection via Exchange Rate Field
The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 5.5.7. This is due to insufficient input validation on the currency exchange rate parameter in the savecurrency AJAX handler, which lacks capability...
WordPress WPML Multilingual & Multicurrency for WooCommerce plugin <= 5.5.7 - Authenticated (Shop Manager+) SQL Injection vulnerability
Authenticated Shop Manager+ SQL Injection vulnerability discovered by Muni Nitish Kumar Yaddala Stranger825 in WordPress Plugin WooCommerce Multilingual & Multicurrency versions = 5.5.7...
CVE-2026-120563
The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to SQL Injection in versions up to and including 5.5.7 . The root cause is insufficient input validation on the currency exchange rate parameter within the save_currency() AJAX handler, which lacks proper ca...
EUVD-2026-115667
The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 5.5.7. This is due to insufficient input validation on the currency exchange rate parameter in the savecurrency AJAX handler, which lacks capability...
CVE-2026-120558 Advanced Shipment Tracking for WooCommerce <= 3.9 - Authenticated (Shop Manager+) SQL Injection via 'tracking_provider' Parameter
The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the trackingprovider parameter of the POST /wp-json/wc-ast/v3/orders//shipment-trackings REST endpoint in all versions up to, and including, 3.9. This is due to insufficient escaping on the...
CVE-2026-120558
The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 3.9 . The flaw exists in the WC_Advanced_Shipment_Tracking_Admin::get_provider_slug_from_name() method due to insufficient escaping and improper use of $wpdb->...
EUVD-2026-115663
The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the trackingprovider parameter of the POST /wp-json/wc-ast/v3/orders//shipment-trackings REST endpoint in all versions up to, and including, 3.9. This is due to insufficient escaping on the...
CVE-2026-1937
🔴 Vulnerability Overview CVE-2026-1937 — Missing Authorization → Arbitrary Options Update → Privilege Escalation Field| Details ---|--- CVE ID| CVE-2026-1937 Severity| HIGH — CVSS v3.1 Score: 7.2 Vector| CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CNA| Wordfence Researcher| Daniel Basta whizzu —...
CVE-2026-118089 WordPress Product Feed Manager plugin <= 7.14.1 - PHP Object Injection vulnerability
Shop manager PHP Object Injection in Product Feed Manager = 7.14.1 versions...
CVE-2026-118089
The Product Feed Manager plugin for WordPress, versions
CVE-2026-118089 WordPress Product Feed Manager plugin <= 7.14.1 - PHP Object Injection vulnerability
Shop manager PHP Object Injection in Product Feed Manager = 7.14.1 versions...
EUVD-2026-114315
Shop manager PHP Object Injection in Product Feed Manager = 7.14.1 versions...
PT-2026-133765
Name of the Vulnerable Software and Affected Versions Product Feed Manager versions 7.14.1 and earlier Description Shop manager is subject to PHP Object Injection, a condition where untrusted input is passed to the PHP unserialize function, potentially allowing an attacker to manipulate objects a...