CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

160 matches found

OSV•added 2026/07/31 4:52 p.m.•8 views

GHSA-X83G-979R-F5FH Sylius Mollie Plugin has unauthenticated IDOR that leaks order token and customer PII

Impact Two unauthenticated Mollie shop endpoints look up orders by a sequential integer orderId with no ownership or session check. Chained, they expose customer PII. GET /locale/thank-you PageRedirectController::thankYouAction, route syliusmollieshopthankyoupageredirect loads the order with...

6.5CVSS5.7AI score0.00341EPSS

SaveExploits0References12

NVD•added 2026/07/30 9:18 p.m.•12 views

CVE-2026-68501

Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's GET /locale/thank-you PageRedirectController::thankYouAction and GET /locale/get-code QrCodeAction::fetchQrCodeFromOrder endpoints look up sequential orderId...

6.5CVSS0.00341EPSS

SaveExploits0References10

Cvelist•added 2026/07/30 8:27 p.m.•37 views

CVE-2026-68501 Sylius Mollie Plugin: Unauthenticated IDOR leaks order token and customer PII

6.5CVSS0.00341EPSS

SaveExploits0References10

ATTACKERKB•added 2026/05/02 1:26 p.m.•2 views

CVE-2026-0703

The NextMove Lite – Thank You Page for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'xlwctycurrentdate' shortcode in all versions up to, and including, 2.23.0 due to insufficient input sanitization and output escaping on user supplied attributes...

6.4CVSS6AI score0.00192EPSS

SaveExploits0References5

Cvelist•added 2026/05/02 1:26 p.m.•49 views

CVE-2026-0703 NextMove Lite - Thank You Page for WooCommerce <= 2.23.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'xlwcty_current_date' Shortcode

6.4CVSS0.00192EPSS

SaveExploits0References4

Vulnrichment•added 2026/05/02 1:26 p.m.•4 views

CVE-2026-0703 NextMove Lite - Thank You Page for WooCommerce <= 2.23.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'xlwcty_current_date' Shortcode

6.4CVSS6AI score0.00192EPSS

SaveExploits0References4

CNNVD•added 2026/05/02 12:0 a.m.•11 views

WordPress plugin NextMove Lite – Thank You Page for WooCommerce 跨站脚本漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be installed t...

6.4CVSS5.7AI score0.00192EPSS

SaveExploits0References1

Patchstack•added 2026/05/01 9:15 a.m.•9 views

WordPress Thank You Page for WooCommerce plugin <= 4.2.0 - Unauthenticated Reflected Cross-Site Scripting vulnerability

Unauthenticated Reflected Cross-Site Scripting vulnerability discovered by Asaf Mozes in WordPress Plugin Thanks Redirect for WooCommerce versions = 4.2.0...

6.1CVSS5.8AI score0.00276EPSS

SaveExploits0References1Affected Software1

RedhatCVE•added 2026/02/21 7:30 p.m.•6 views

CVE-2025-68048

Missing Authorization vulnerability in XLPlugins NextMove Lite woo-thank-you-page-nextmove-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NextMove Lite: from n/a through = 2.23.0...

7.5CVSS5.5AI score0.00291EPSS

SaveExploits0References1

Vulnrichment•added 2026/02/20 3:46 p.m.•2 views

CVE-2025-68048 WordPress NextMove Lite plugin <= 2.23.0 - Broken Access Control vulnerability

5.3AI score0.00291EPSS

SaveExploits0References1

Patchstack•added 2025/12/31 12:0 a.m.•9 views

WordPress Contact Form 7 Redirect & Thank You Page plugin <= 1.0.7 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin Contact Form 7 Redirect & Thank You Page versions = 1.0.7...

6.1CVSS5.4AI score0.00353EPSS

SaveExploits0References1Affected Software1

RedhatCVE•added 2025/12/10 2:22 p.m.•8 views

CVE-2025-66528

Missing Authorization vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Thank You Page Customizer for WooCommerce: from n/a through = 1.1.8...

4.3CVSS6.7AI score0.00229EPSS

SaveExploits0References1

EUVD•added 2025/12/09 6:30 p.m.•7 views

EUVD-2025-202144

6.2AI score0.00229EPSS

SaveExploits0References2

NVD•added 2025/12/09 4:18 p.m.•8 views

CVE-2025-66528

4.3CVSS0.00229EPSS

SaveExploits0References1

CVE•added 2025/12/09 2:13 p.m.•18 views

CVE-2025-66528

CVE-2025-66528 refers to a Missing Authorization / Broken Access Control vulnerability in the WordPress plugin "Thank You Page Customizer for WooCommerce" (woo-thank-you-page-customizer), affecting versions

4.3CVSS6.3AI score0.00229EPSS

SaveExploits0References1

Cvelist•added 2025/12/09 2:13 p.m.•28 views

CVE-2025-66528 WordPress Thank You Page Customizer for WooCommerce plugin <= 1.1.8 - Broken Access Control vulnerability

4.3CVSS0.00229EPSS

SaveExploits0References1

Vulnrichment•added 2025/12/09 2:13 p.m.•2 views

CVE-2025-66528 WordPress Thank You Page Customizer for WooCommerce plugin <= 1.1.8 - Broken Access Control vulnerability

6.3AI score0.00229EPSS

SaveExploits0References1

Positive Technologies•added 2025/12/09 12:0 a.m.•10 views

PT-2025-49876

8.1CVSS6.7AI score0.00229EPSS

SaveExploits0References3

CNNVD•added 2025/12/09 12:0 a.m.•8 views

WordPress plugin Thank You Page Customizer for WooCommerce 安全漏洞

...

4.3CVSS5.8AI score0.00229EPSS

SaveExploits0References1

Patchstack•added 2025/12/05 8:17 a.m.•8 views

WordPress Thank You Page Customizer for WooCommerce plugin <= 1.1.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by daroo in WordPress Plugin Thank You Page Customizer for WooCommerce versions = 1.1.8...

8.1CVSS6.8AI score0.00229EPSS

SaveExploits0Affected Software1

Rows per page

Query Builder

Family

Bulletin Type

Min CVSS Score

Date

Order by