EUVD-2026-114315

Shop manager PHP Object Injection in Product Feed Manager = 7.14.1 versions...

CVE-2026-118089

The Product Feed Manager plugin for WordPress, versions

CVE-2026-118089 WordPress Product Feed Manager plugin <= 7.14.1 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in Product Feed Manager = 7.14.1 versions...

CVE-2026-1937

🔴 Vulnerability Overview CVE-2026-1937 — Missing Authorization → Arbitrary Options Update → Privilege Escalation Field| Details ---|--- CVE ID| CVE-2026-1937 Severity| HIGH — CVSS v3.1 Score: 7.2 Vector| CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CNA| Wordfence Researcher| Daniel Basta whizzu —...

CVE-2026-118074

Shop manager PHP Object Injection in Finale Lite = 2.21.0 versions...

CVE-2026-116869

Shop manager PHP Object Injection in myPOS Checkout = 1.4.5 versions...

CVE-2026-118079

The FV Flowplayer Video Player plugin for WordPress, version 8.3.4 and below , is susceptible to a PHP Object Injection vulnerability. The underlying cause is related to the deserialization of untrusted data (CWE-507). This vulnerability could allow an attacker with high privileges to impact the ...

CVE-2026-118078 WordPress Product Catalog Feed by PixelYourSite plugin <= 3.1.4 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite = 3.1.4 versions...

CVE-2026-118078

The Product Catalog Feed by PixelYourSite WordPress plugin (versions

EUVD-2026-112995

Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite = 3.1.4 versions...

CVE-2026-118074

The Finale Lite WordPress plugin (versions

CVE-2026-118074 WordPress Finale Lite plugin <= 2.21.0 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in Finale Lite = 2.21.0 versions...

CVE-2026-116869 WordPress myPOS Checkout plugin <= 1.4.5 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in myPOS Checkout = 1.4.5 versions...

CVE-2026-116869

The WordPress myPOS Checkout plugin versions

CVE-2026-42701

The YayMail WordPress plugin, specifically versions

CVE-2026-42701 WordPress YayMail plugin <= 4.4.6 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in YayMail = 4.4.6 versions...

CVE-2026-109988

The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fieldssectionfieldsrowcoltype' parameter in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping. This...

CVE-2026-109381

The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8 This is due to the mepgrantshopmanageraccess function hooking userhascap and unconditionally granting manageoptions whenever an attacker-controllable request marker matches — mos...

CVE-2026-109988 Product Addons for Woocommerce <= 3.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'type' Field Parameter

The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fieldssectionfieldsrowcoltype' parameter in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping. This...

CVE-2026-109988

The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.1.8 . The root cause is insufficient input sanitization and output escaping within the fields[section][fields][row]...