CVE-2026-2292 Morkva UA Shipping <= 1.7.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Weight, kg' Field

The Morkva UA Shipping plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.7.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

WordPress Morkva UA Shipping plugin <= 1.7.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Weight, kg' Field vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting via 'Weight, kg' Field vulnerability discovered by Phap Nguyen Anh - FIS in WordPress Plugin Morkva UA Shipping versions = 1.7.9...

Business Logic Errors

yetiforce/yetiforce-crm is vulnerable to business logic errors. The vulnerability exists due to an insufficient validation for weight fields...