CVE-2026-18750

The CVE-2026-18750 issue affects vinny/views.py in the ModifyEmailNotifications path, where an IDOR flaw allows fetching VinceCommEmail by a raw primary key from the URL and toggling email_function/name without verifying that the contact belongs to the requesting vendor-admin’s group. This could ...

WooCommerce Product Vendors < 2.1.77 - Vendor Admin+ SQLi

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as Admin Vendor and above As an Admin vendor, open the URL below...