CVE-2026-16739 Epeken All Kurir <= 2.1.4 - Unauthenticated Order Payment Confirmation Forgery

The Epeken All Kurir for Woocommerce WordPress plugin through 2.1.4 does not verify that a payment-confirmation request originates from the owner of the targeted order, nor that any payment actually occurred, allowing unauthenticated attackers to mark arbitrary orders as confirmed and, in a...

CVE-2026-16739

The Epeken All Kurir for Woocommerce WordPress plugin (versions through 2.1.4 ) contains an improper authentication vulnerability. The plugin fails to verify if a payment-confirmation request originates from the legitimate order owner or if a payment actually occurred. This allows unauthenticated...

PT-2026-71967

Name of the Vulnerable Software and Affected Versions Epeken All Kurir for Woocommerce WordPress versions prior to 2.1.3 Description An issue exists where the plugin fails to verify if a payment-confirmation request is sent by the order owner or if a payment was actually processed. This allows...

CVE-2026-66655 WordPress MultiParcels Shipping For WooCommerce plugin <= 1.30.36 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in MultiParcels Shipping For WooCommerce = 1.30.36 versions...

CVE-2026-14182

The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the accoun...

CVE-2026-14182 Customer Email Verification for WooCommerce < 3.2.6 - Unauthenticated Account Takeover via Type-Juggling Authentication Bypass

The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the accoun...

PT-2026-71601

Administrator SQL Injection in MailChimp For WooCommerce 6.2 versions...

CVE-2026-15045

The Wallet System for WooCommerce WordPress plugin before 2.7.10 does not validate a user-supplied wallet amount against the customer's actual stored balance during checkout, allowing authenticated customers to arbitrarily reduce their own order total, including down to zero, and complete checkou...

CVE-2026-16621

The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that payment actually succeeded before completing an order in its PayPal return handler: it reads attacker-controlled parameters, performs no amount comparison and no order-ownership check, and completes t...

CVE-2026-16538 TeraWallet - Wallet for WooCommerce < 1.6.10 - Subscriber+ Wallet Balance Inflation via Discounted Top-Up

The Wallet for WooCommerce WordPress plugin before 1.6.10 does not verify the amount actually collected for a wallet top-up before crediting the wallet, allowing customers to top up their wallet balance for less than its value...

WordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.10.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Asim Alshaya in WordPress Plugin Colissimo Officiel : Méthodes de livraison pour WooCommerce versions = 2.10.0...

CVE-2026-19089

The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded file types when its accepted-types setting is left empty, which its own documentation advertises as accepting all files, allowing unauthenticated attackers to upload arbitrary files and achieve remot...

CVE-2026-17016

The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not validate the amount actually paid against the order total in its PayPal Data Transfer return handler, allowing a customer to pay less than the order total and still have the order marked as fully...

CVE-2026-17012

The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not verify that the PayPal account which received a payment matches the merchant's configured account before marking the order as paid, allowing unauthenticated buyers to complete a WooCommerce order...

CVE-2026-14941

The Customer Reviews for WooCommerce WordPress plugin before 5.116.0 does not perform nonce or capability checks on several settings-related AJAX actions, allowing users with minimal permissions such as Subscribers to invoke administrative settings handlers, update Customer Reviews for WooCommerc...

EUVD-2026-55001

The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded file types when its accepted-types setting is left empty, which its own documentation advertises as accepting all files, allowing unauthenticated attackers to upload arbitrary files and achieve remot...

CVE-2026-19089 Product Input Fields for WooCommerce < 2.0.2 - Unauthenticated Arbitrary File Upload

The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded file types when its accepted-types setting is left empty, which its own documentation advertises as accepting all files, allowing unauthenticated attackers to upload arbitrary files and achieve remot...

CVE-2026-19089

The Product Input Fields for WooCommerce WordPress plugin (versions prior to 2.0.2 ) is vulnerable to an unauthenticated arbitrary file upload due to a lack of file type validation. If the accepted-types setting is left empty—a configuration documented to accept all files—attackers can upload arb...

EUVD-2026-55018

The Customer Reviews for WooCommerce WordPress plugin before 5.116.0 does not perform nonce or capability checks on several settings-related AJAX actions, allowing users with minimal permissions such as Subscribers to invoke administrative settings handlers, update Customer Reviews for WooCommerc...

CVE-2026-14941

The Customer Reviews for WooCommerce WordPress plugin (versions before 5.116.0 ) is vulnerable to an authorization bypass due to missing nonce or capability checks on multiple settings-related AJAX actions . This allows users with minimal permissions, such as Subscribers , to invoke administrativ...