CVE-2026-2592 Zarinpal Gateway for WooCommerce <= 5.0.16 - Improper Access Control to Payment Status Update

The Zarinpal Gateway for WooCommerce plugin for WordPress is vulnerable to Improper Access Control to Payment Status Update in all versions up to and including 5.0.16. This is due to the payment callback handler 'ReturnfromZarinPalGateway' failing to validate that the authority token provided in...

CVE-2026-23184

creationtimestamp| type| source ---|---|--- 2026-02-14 18:02:36+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116070295502235332...

CVE-2026-21525

creationtimestamp| type| source ---|---|--- 2026-02-10 17:30:28+00:00| seen| https://www.thezdi.com/blog/2026/2/10/the-february-2026-security-update-review 2026-02-10 18:01:45+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0053 2026-02-10 18:53:06+00:00| seen|...

CVE-2026-25858

creationtimestamp| type| source ---|---|--- 2026-02-08 00:00:56+00:00| seen| https://infosec.exchange/users/offseq/statuses/116032067514723066 2026-02-08 10:30:33+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3medq3l2nc724 2026-02-08 10:30:46+00:00| seen|...

CVE-2026-0679

The Fortis for WooCommerce plugin for WordPress is vulnerable to authorization bypass due to an inverted nonce check in the 'checkfortisnotifyresponse' function in all versions up to, and including, 1.2.0. This makes it possible for unauthenticated attackers to update arbitrary WooCommerce order...

CVE-2026-0679

The Fortis for WooCommerce plugin for WordPress is vulnerable to authorization bypass due to an inverted nonce check in the 'checkfortisnotifyresponse' function in all versions up to, and including, 1.2.0. This makes it possible for unauthenticated attackers to update arbitrary WooCommerce order...

CVE-2026-0679

Fortis for WooCommerce (WordPress) is affected by an authorization bypass up to and including version 1.2.0 due to an inverted nonce check in check_fortis_notify_response, enabling unauthenticated attackers to change arbitrary WooCommerce order statuses (paid/processing/completed) via the wc-api ...

CVE-2026-0679 Fortis for WooCommerce <= 1.2.0 - Missing Authorization to Unauthenticated Arbitrary Order Status Update to Paid via 'wc-api' Endpoint

The Fortis for WooCommerce plugin for WordPress is vulnerable to authorization bypass due to an inverted nonce check in the 'checkfortisnotifyresponse' function in all versions up to, and including, 1.2.0. This makes it possible for unauthenticated attackers to update arbitrary WooCommerce order...

EUVD-2026-5411

The Fortis for WooCommerce plugin for WordPress is vulnerable to authorization bypass due to an inverted nonce check in the 'checkfortisnotifyresponse' function in all versions up to, and including, 1.2.0. This makes it possible for unauthenticated attackers to update arbitrary WooCommerce order...

CVE-2025-14461

The CVE describes unauthenticated order-status manipulation in the Xendit Payment plugin for WordPress (WooCommerce integration). Versions up to and including 6.0.2 expose a publicly accessible API callback endpoint (wc_xendit_callback) that processes payment callbacks without authenticating orig...

CVE-2025-14461 Xendit Payment <= 6.0.2 - Missing Authorization to Unauthenticated Arbitrary Order Status Update to Paid

The Xendit Payment plugin for WordPress is vulnerable to unauthorized order status manipulation in all versions up to, and including, 6.0.2. This is due to the plugin exposing a publicly accessible WooCommerce API callback endpoint wcxenditcallback that processes payment callbacks without any...

WordPress Xendit Payment plugin <= 6.0.2 - Missing Authorization to Unauthenticated Arbitrary Order Status Update to Paid vulnerability

Missing Authorization to Unauthenticated Arbitrary Order Status Update to Paid vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan - Knight Squad in WordPress Plugin Xendit Payment versions = 6.0.2...

CVE-2019-14043

creationtimestamp| type| source ---|---|--- 2026-01-20 08:05:00+00:00| seen| https://infosec.exchange/users/certvde/statuses/115926387351405846...

CVE-2022-33223

creationtimestamp| type| source ---|---|--- 2026-01-20 08:04:59+00:00| seen| https://infosec.exchange/users/certvde/statuses/115926387351405846...

CVE-2022-25738

creationtimestamp| type| source ---|---|--- 2026-01-20 08:04:56+00:00| seen| https://infosec.exchange/users/certvde/statuses/115926387351405846...

CVE-2025-1766

The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'paymentcomplete' function in all versions up to, and including, 4.0.24. This makes it possible for unauthenticated...

CVE-2025-15224

creationtimestamp| type| source ---|---|--- 2026-01-07 07:01:33+00:00| seen| https://seclists.org/oss-sec/2026/q1/36 2026-01-07 07:51:28+00:00| seen| https://infosec.exchange/users/harrysintonen/statuses/115852724607348302 2026-01-07 08:43:27+00:00| seen|...

CVE-2020-36909

creationtimestamp| type| source ---|---|--- 2026-01-06 16:10:57+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115849026353201544 2026-01-06 16:39:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbrfcswu4x2y 2026-01-07 21:03:06+00:00| seen|...

CVE-2020-36910

creationtimestamp| type| source ---|---|--- 2026-01-06 16:10:57+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115849026353201544 2026-01-06 16:52:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbrfzjx42y2c 2026-01-07 21:03:07+00:00| seen|...

CVE-2020-36914

creationtimestamp| type| source ---|---|--- 2026-01-06 16:10:57+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115849026353201544 2026-01-06 16:46:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbrfpbmnza2c 2026-01-07 21:03:09+00:00| seen|...