WordPress Advanced Order Export For WooCommerce <3.1.8 - Authenticated Cross-Site Scripting

WordPress Advanced Order Export For WooCommerce plugin before 3.1.8 contains an authenticated cross-site scripting vulnerability via the tab parameter in the admin panel. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can...

Woo Inquiry <= 0.1 - SQL Injection

The Woo Inquiry plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 0.1 due to insufficient escaping on the user supplied parameter 'dbid' and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to...

CVE-2024-7854

CVE-2024-7854 Woo Inquiry = 0.1 - 未授权SQL注入 描述： WordPress的Woo Inquiry插件在所有版本（包括0.1）中存在SQL注入漏洞，原因是用户提供的参数'dbid'转义不充分，且现有SQL查询准备不充分。这使得未授权攻击者能够将额外的SQL查询附加到已有查询中，从而用于从数据库中提取敏感信息。 root@kitploit: Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' CVSS...

EUVD-2026-82670

The Price Drop Alert for Woo Commerce WordPress plugin through 1.1 does not sanitize and escape parameters before using them in a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the...

CVE-2026-77695 Woo Refund And Exchange Lite < 4.6.4 - Unauthenticated Guest Order Message Disclosure and Manipulation

The Return Refund and Exchange For WooCommerce WordPress plugin before 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX actions it exposes to unauthenticated users, allowing them to read private order messages, post messages and attachments in the customer's name,...

CVE-2026-77695

CVE-2026-77695 affects the Return Refund and Exchange For WooCommerce WordPress plugin in versions prior to 4.6.4 . The root cause is that certain AJAX actions exposed to unauthenticated users do not correctly verify the ownership of guest orders . An unauthenticated attacker can exploit this to ...

CVE-2026-77695 Woo Refund And Exchange Lite < 4.6.4 - Unauthenticated Guest Order Message Disclosure and Manipulation

The Return Refund and Exchange For WooCommerce WordPress plugin before 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX actions it exposes to unauthenticated users, allowing them to read private order messages, post messages and attachments in the customer's name,...

CVE-2026-32551

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in DiviNext Woo Essential allows SQL Injection. This issue affects Woo Essential: from n/a through 4.3.0...

CVE-2026-32551 WordPress Woo Essential plugin <= 4.3.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in DiviNext Woo Essential allows SQL Injection. This issue affects Woo Essential: from n/a through 4.3.0...

EUVD-2026-64803

Unauthenticated SQL Injection in Woo Essential = 4.3.0 versions...

CVE-2026-32551

CVE-2026-32551 is an unauthenticated SQL injection in the Woo Essential WordPress plugin, affecting versions ≤ 4.3.0 . Rated CVSS 9.3 (Critical) by Patchstack , the vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) indicates network-accessible exploitation with high confidentiality impact and scope ch...

CVE-2026-32551 WordPress Woo Essential plugin <= 4.3.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in DiviNext Woo Essential allows SQL Injection. This issue affects Woo Essential: from n/a through 4.3.0...

EUVD-2026-54400

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not validate the payment amount or bind the PayPal order token to the order being completed on the WooCommerce order-received flow: it captures a client-supplied token and marks the order paid whenever the capture status is...

CVE-2026-15662

The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bgcolor' parameter in all versions up to, and including, 2.48 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-18059 PixelYourSite <= 11.2.1 - Unauthenticated Sensitive Information Exposure via Order-Received Endpoint Missing Key Validation

The PixelYourSite – Your smart PIXEL TAG & API Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.2.1 via the getWooPurchaseEventParams. This makes it possible for unauthenticated attackers to extract WooCommerce purchase metadata...

CVE-2026-15662

CVE-2026-15662 affects the WordPress plugin “Advanced Woo Labels – Product Labels & Badges for WooCommerce” up to version 2.48. The vulnerability is a Stored Cross-Site Scripting via the bg_color parameter, caused by insufficient input sanitization and output escaping. An attacker with contributo...

EUVD-2026-51746

The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bgcolor' parameter in all versions up to, and including, 2.48 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-15662

The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bgcolor' parameter in all versions up to, and including, 2.48 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-12736

The Wpify Woo plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 5.4.16. This is due to the SettingsApi::saveoption REST route POST /wp-json/wpify-woo/v1/option passing the request-supplied 'option' and 'data' parameters directly to updateoption without a...

CVE-2026-12736

The Wpify Woo plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 5.4.16. This is due to the SettingsApi::saveoption REST route POST /wp-json/wpify-woo/v1/option passing the request-supplied 'option' and 'data' parameters directly to updateoption without a...