CVE-2025-4603

eMagicOne Store Manager para WooCommerce = 1.2.5 - Eliminación Arbitraria de Archivos sin Autenticación El plugin eMagicOne Store Manager para WooCommerce expone un endpoint de protocolo de gestión remota ?connector=bridge que permite operaciones de eliminación de archivos en el servidor. El...

CVE-2025-5058

eMagicOne Store Manager for WooCommerce Warning: Trying to access array offset on false in /home/vagrant/research/Lab1/wp-content/plugins/store-manager-connector/classes/class-emosmcwoocommerceoverrider.php on line 324 Warning: Trying to access array offset on false in...

CVE-2025-4602

eMagicOne Store Manager for WooCommerce = 1.2.5 - 未经认证的任意文件读取 eMagicOne Store Manager for WooCommerce 插件暴露了一个远程管理协议端点（?connector=bridge），允许在服务器上执行文件删除操作。其认证机制依赖于一组默认凭据（login=1，password=1）和会话密钥系统。如果默认凭据未被更改，攻击者可以轻易地进行认证，获取会话密钥，并从 WordPress 根目录或任何可访问的目录读取任意文件。 复现 提供了一个 POC CVE-2025-4602.py 来演示从服务器读...

CVE-2025-4336

eMagicOne Store Manager para WooCommerce 1: lo: mtu 65536...

WordPress Shopping Cart & eCommerce Store plugin <= 5.9.3 - Authenticated (Store Manager+) Privilege Escalation to ec_ajax_save_page_default_options AJAX Action vulnerability

Authenticated Store Manager+ Privilege Escalation to ecajaxsavepagedefaultoptions AJAX Action vulnerability discovered by Wordfence PRISM in WordPress Plugin WP EasyCart versions = 5.9.3...

EUVD-2026-74600

The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.9.3. This is due to the ecajaxsavepagedefaultoptions AJAX handler iterating over every $POST key and passing it directly into updateoption without any allowlist, while gating the handler...

CVE-2026-17553 Shopping Cart & eCommerce Store <= 5.9.3 - Authenticated (Store Manager+) Privilege Escalation to ec_ajax_save_page_default_options AJAX Action

The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.9.3. This is due to the ecajaxsavepagedefaultoptions AJAX handler iterating over every $POST key and passing it directly into updateoption without any allowlist, while gating the handler...

CVE-2026-17553

The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to and including 5.9.3 . The ec_ajax_save_page_default_options() AJAX handler iterates over every $_POST key and passes it directly into update_option() without an allowlist. Access is gated on the manage_op...

PT-2026-88789

The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.9.3. This is due to the ec ajax save page default options AJAX handler iterating over every $ POST key and passing it directly into update option without any allowlist, while gating the...

CVE-2026-42773

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in eMagicOne eMagicOne Store Manager allows Blind SQL Injection. This issue affects eMagicOne Store Manager: from n/a through 1.3.2...

CVE-2026-42773

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in eMagicOne eMagicOne Store Manager allows Blind SQL Injection. This issue affects eMagicOne Store Manager: from n/a through 1.3.2...

CVE-2026-42773

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in eMagicOne eMagicOne Store Manager allows Blind SQL Injection. This issue affects eMagicOne Store Manager: from n/a through 1.3.2...

CVE-2026-42773

CVE-2026-42773 concerns the WordPress plugin eMagicOne Store Manager (versions up to 1.3.2). The connected documents identify a vulnerability of type SQL Injection (specifically a blind SQL injection) in this plugin. Affected component is the Store Manager code path handling SQL commands, with th...

CVE-2026-42773 WordPress eMagicOne Store Manager plugin <= 1.3.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in eMagicOne eMagicOne Store Manager allows Blind SQL Injection. This issue affects eMagicOne Store Manager: from n/a through 1.3.2...

EUVD-2026-31749

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in eMagicOne eMagicOne Store Manager allows Blind SQL Injection. This issue affects eMagicOne Store Manager: from n/a through 1.3.2...

CVE-2026-42773 WordPress eMagicOne Store Manager plugin <= 1.3.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in eMagicOne eMagicOne Store Manager allows Blind SQL Injection. This issue affects eMagicOne Store Manager: from n/a through 1.3.2...

CVE-2026-42773: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in eMagicOne eMagicOne Store Manager allows Blind SQL Injection. This issue affects eMagicOne Store Manager: from n/a through 1.3.2...

WordPress plugin eMagicOne Store Manager SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A SQL injection...

WordPress eMagicOne Store Manager plugin <= 1.3.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ossacip Thanh in WordPress Plugin eMagicOne Store Manager versions = 1.3.2...

CVE-2026-1750

The Ecwid by Lightspeed Ecommerce Shopping Cart plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.0.7. This is due to a missing capability check in the 'savecustomuserprofilefields' function. This makes it possible for authenticated attackers, with...