3867 matches found
CVE-2026-15215
The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify the user's capability before installing and activating a Subscriptions for WooCommerce WordPress plugin before 2.0.1 from a user-supplied slug through a nonce-protected AJAX action, allowing users with the Shop Manage...
CVE-2026-14331
The Subscribe2 WordPress plugin before 10.46 does not properly escape a user-supplied value before reflecting it into a public subscription form, leading to Reflected Cross-Site Scripting that executes in the browser of an unauthenticated visitor who interacts with the form through a crafted link...
CVE-2026-15214
The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify that the requester owns the subscription being viewed before rendering its details, allowing any authenticated customer to read another customer's subscription information the subscribed product, status, and dates by...
EUVD-2026-54379
The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify that the requester owns the subscription being viewed before rendering its details, allowing any authenticated customer to read another customer's subscription information the subscribed product, status, and dates by...
CVE-2026-15214
The Subscriptions for WooCommerce WordPress plugin, in versions before 2.0.1 , is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The plugin fails to verify if a requester owns a specific subscription before rendering its details. This allows any authenticated customer to access an...
CVE-2026-15215
The Subscriptions for WooCommerce WordPress plugin (versions before 2.0.1 ) is vulnerable to remote code execution (RCE) due to improper privilege management. The plugin fails to verify user capabilities before installing and activating a plugin from a user-supplied slug via a nonce-protected AJA...
CVE-2026-15214 Subscriptions for WooCommerce < 2.0.1 - Subscriber+ Subscription Detail Disclosure via IDOR
The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify that the requester owns the subscription being viewed before rendering its details, allowing any authenticated customer to read another customer's subscription information the subscribed product, status, and dates by...
CVE-2026-15214 Subscriptions for WooCommerce < 2.0.1 - Subscriber+ Subscription Detail Disclosure via IDOR
The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify that the requester owns the subscription being viewed before rendering its details, allowing any authenticated customer to read another customer's subscription information the subscribed product, status, and dates by...
EUVD-2026-54376
The Subscribe2 WordPress plugin before 10.46 does not properly escape a user-supplied value before reflecting it into a public subscription form, leading to Reflected Cross-Site Scripting that executes in the browser of an unauthenticated visitor who interacts with the form through a crafted link...
CVE-2026-14331 Subscribe2 < 10.46 - Reflected XSS via email Parameter
The Subscribe2 WordPress plugin before 10.46 does not properly escape a user-supplied value before reflecting it into a public subscription form, leading to Reflected Cross-Site Scripting that executes in the browser of an unauthenticated visitor who interacts with the form through a crafted link...
EUVD-2026-54303
The Formidable Forms WordPress plugin before 6.32.1 does not properly validate the status of a PayPal subscription payment before marking it complete, allowing unauthenticated users to bypass payment and trigger paid form actions — such as digital content access, license delivery, and membership...
PT-2026-68860
Name of the Vulnerable Software and Affected Versions Subscriptions for WooCommerce versions prior to 2.0.1 Description An Insecure Direct Object Reference IDOR exists where the plugin fails to verify if the requester owns the subscription before displaying its details. This allows any...
CVE-2026-47127: Missing Authorization
Ghostfolio is an open source wealth management software. Prior to version 3.4.0, Ghostfolio's Stripe checkout success-URL handler at GET /api/v1/subscription/stripe/callback?checkoutSessionId= retrieves the Stripe Checkout Session by ID and unconditionally grants a Premium subscription to the...
CVE-2026-15214: Authorization Bypass Through User-Controlled Key
The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify that the requester owns the subscription being viewed before rendering its details, allowing any authenticated customer to read another customer's subscription information the subscribed product, status, and dates by...
CVE-2026-14331: Improper Neutralization of Input During Web Page Generation
The Subscribe2 WordPress plugin before 10.46 does not properly escape a user-supplied value before reflecting it into a public subscription form, leading to Reflected Cross-Site Scripting that executes in the browser of an unauthenticated visitor who interacts with the form through a crafted link...
PT-2026-69158
Name of the Vulnerable Software and Affected Versions Ghostfolio versions prior to 3.4.0 Description The Stripe checkout success-URL handler at GET /api/v1/subscription/stripe/callback?checkoutSessionId= retrieves the Stripe Checkout Session by ID and grants a Premium subscription to the client...
CVE-2026-19127
An issue in the billing and license activation subsystem allows remote attackers to bypass payment authorization workflows. By exploiting insufficient cryptographic validation or lack of server-side state verification on promotional/lifetime-deal LTD redemption codes, an unauthenticated attacker...
Authentication Bypass by Assumed-Immutable Data
Overview @neo4j/graphql is an A GraphQL to Cypher query execution layer for Neo4j and JavaScript GraphQL implementations Affected versions of this package are vulnerable to Authentication Bypass by Assumed-Immutable Data in the connectionParams.jwt process. An attacker can gain unauthorized acces...
CVE-2026-11361
Formidable Forms for WordPress (before 6.32.1) is affected by CVE-2026-11361 due to improper validation of PayPal subscription status, enabling unauthenticated users to bypass payment and trigger paid actions (content access, license delivery, membership activation) without charges. Impact aligns...
CVE-2026-11361 Formidable Forms < 6.32.1 - Unauthenticated Payment Bypass via PayPal APPROVAL_PENDING Subscription Status
The Formidable Forms WordPress plugin before 6.32.1 does not properly validate the status of a PayPal subscription payment before marking it complete, allowing unauthenticated users to bypass payment and trigger paid form actions — such as digital content access, license delivery, and membership...