CVE-2026-39723

Unauthenticated Broken Access Control in Morning for WooCommerce = 2.4.1 versions...

CVE-2026-32576

Customer Insecure Direct Object References IDOR in Faktur Pro for WooCommerce = 3.2.1 versions...

CVE-2026-89289

The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying its id...

CVE-2026-39723

The Morning for WooCommerce plugin (versions

CVE-2026-39723 WordPress Morning for WooCommerce plugin <= 2.4.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Morning for WooCommerce = 2.4.1 versions...

EUVD-2026-92954

Unauthenticated Broken Access Control in Morning for WooCommerce = 2.4.1 versions...

CVE-2026-32576 WordPress Faktur Pro for WooCommerce plugin <= 3.2.1 - Insecure Direct Object References (IDOR) vulnerability

Customer Insecure Direct Object References IDOR in Faktur Pro for WooCommerce = 3.2.1 versions...

EUVD-2026-92951

Customer Insecure Direct Object References IDOR in Faktur Pro for WooCommerce = 3.2.1 versions...

CVE-2026-32576

The Faktur Pro for WooCommerce plugin, specifically versions

CVE-2026-10580

WordPress - Hippoo Mobile App for WooCommerce = 1.9.4 - Authentication Bypass to Admin Account Takeover Overview This tool is a proof-of-concept exploit for CVE-2026-10580 , an authentication bypass vulnerability affecting the Hippoo Mobile App for WooCommerce WordPress plugin versions = 1.9.4. T...

CVE-2026-103349

The Product Feed PRO for WooCommerce plugin (versions ≤ 13.5.7 ) by Rymera Web Co is vulnerable to PHP Object Injection due to the Deserialization of Untrusted Data (CWE-502). This flaw allows an attacker to inject objects into the application. While the CVSS 3.1 score is 7.2 (High) , the attack ...

EUVD-2026-92593

Deserialization of Untrusted Data vulnerability in Rymera Web Co Product Feed PRO for WooCommerce woo-product-feed-pro allows Object Injection.This issue affects Product Feed PRO for WooCommerce: from n/a through 13.5.7...

CVE-2026-97275

The VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin (versions n/a through 1.0.28 ) is vulnerable to Improper Validation of Specified Quantity in Input (CWE-1284). This flaw allows for Input Data Manipulation , which can be used to bypass intended logic within the ...

EUVD-2026-92589

Improper Validation of Specified Quantity in Input vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Input Data Manipulation.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC Builder: from n/a through 1.0....

CVE-2026-100515

The VillaTheme Photo Reviews for WooCommerce (woo-photo-reviews ) WordPress plugin is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. This issue affects versions up to and including 1.2.30 . Exploitation details are not provid...

EUVD-2026-92583

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Reflected XSS.This issue affects Photo Reviews for WooCommerce: from n/a through 1.2.30...

CVE-2024-13513

Oliver POS – WooCommerce 판매 시점 관리POS 플러그인 = 2.4.2.3 - 민감 정보 노출로 인한 권한 상승 계정 탈취 CVE-2024-13513 Oliver POS – WooCommerce 판매 시점 관리POS 플러그인 for WordPress는 2.4.2.3 이하 모든 버전에서 로깅 기능을 통해 민감 정보 노출에 취약합니다. 이로 인해 인증되지 않은 공격자가 플러그인의 clientToken을 포함한 민감 데이터를 추출할 수 있으며, 이를 통해 이메일 및 계정 유형을 포함한 사용자 계정 정보를 변경할 수...

CVE-2025-4603

eMagicOne Store Manager for WooCommerce md5 EMOSMCDEFAULTLOGIN . EMOSMCDEFAULTPASSWORD , 결과: 기본 해시는 md5'1' . '1' = c4ca4238a0b923820dcc509a6f75849b입니다. 세션 키 획득 세션 키는 해시와 작업예: getversion을 포함한 POST 요청을 브리지 엔드포인트로 보내 얻습니다: POST /?connector=bridge Content-Type: application/x-www-form-urlencoded...

CVE-2026-3891-Pix-for-WooCommerce-Plugin-Exploit

CVE-2026-3891-Pix-for-WooCommerce-Plugin-Exploit 🛡️ 설명 CVE-2026-3891 은 Pix for WooCommerce WordPress 플러그인의 1.5.0 및 이전 버전 에서 발견된 치명적인 인증되지 않은 임의 파일 업로드Unauthenticated Arbitrary File Upload 취약점입니다. 이 취약점은 lknpixforwoocommercec6savesettings 기능에 존재하며, 인증 제어 누락과 불충분한 파일 유형 검증으로 인해 발생합니다. 이 익스플로잇은 유효한...

CVE-2025-4403

CVE-2025-4403 익스플로잇 세부 정보 게시일 : 2025년 5월 8일 업데이트일 : 2025년 5월 9일 심각도 : 높음 CVSS 점수: 9.8 CWE : CWE-434 - 위험한 유형의 파일 무제한 업로드 영향받는 버전 : n/a부터 1.1.6까지의 모든 버전 CVSS 벡터 CVSS 버전 : 9.8 벡터 문자열 : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 설명 WordPress용 WooCommerce 플러그인의 Drag and Drop Multiple File Upload는...