CVE-2026-12736

The Wpify Woo plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 5.4.16. This is due to the SettingsApi::saveoption REST route POST /wp-json/wpify-woo/v1/option passing the request-supplied 'option' and 'data' parameters directly to updateoption without a...

WordPress Product Image Watermark for Woo Plugin <= 1.0.5 is vulnerable to Cross Site Scripting (XSS)

Software Product Image Watermark for Woo Type Plugin Vulnerable versions = 1.0.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 75275bbab7e3 Credits Rafie Muhammad...

WordPress BSD Split Pay for Stripe Connect on Woo Plugin < 3.2.10 is vulnerable to Cross Site Scripting (XSS)

Software BSD Split Pay for Stripe Connect on Woo Type Plugin Vulnerable versions 3.2.10 Fixed in 3.2.10 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 4cfd0c7adef7 Credits Rafie...

WordPress BSD Split Pay for Stripe Connect on Woo plugin <= 3.2.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress BSD Split Pay for Stripe Connect on Woo plugin versions = 3.2.0. Solution Update the WordPress BSD Split Pay for Stripe Connect on Woo plugin to the latest available version at least 3.2.1...

WordPress Sticky add to cart for Woo plugin <= 1.0.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Sticky add to cart for Woo plugin versions = 1.0.2. Solution No patched version available...

WordPress BSD Split Pay for Stripe Connect on Woo plugin <= 3.2.0 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress BSD Split Pay for Stripe Connect on Woo plugin versions = 3.2.0. Solution Update the WordPress BSD Split Pay for Stripe Connect on Woo plugin to the latest available version at least 3.2.1...