CVE-2025-15260

CVE-2025-15260: Autorizzazione Mancante / Controllo di Accesso Interrotto nel Plugin - MyRewards – Loyalty Points and Rewards for WooCommerce Disclaimer: Questo repository è creato solo per scopi educativi e divulgazione etica. La vulnerabilità è stata segnalata responsabilmente al fornitore e...

CVE-2025-29009

CVE-2025-29009 Il plugin WordPress Medical Prescription Attachment per WooCommerce = 1.2.3 è vulnerabile a un caricamento arbitrario di file ad alta priorità. CVE-2025-29009 Webkul Medical Prescription Attachment — Caricamento di file senza restrizioni → Web Shell root@kitploit: ,-. . , ,--. ,-...

CVE-2023-28121

CVE-2023-28121 Note di ricerca e materiale di supporto per lo studio di CVE-2023-28121 in un laboratorio controllato WordPress/WooCommerce Payments. Avviso di sicurezza Utilizzare questo materiale solo in sistemi di propria proprietà o per i quali si dispone di esplicita autorizzazione al test...

CVE-2026-49777

CVE-2026-49777 CVE-2026-49777 - ShapedPlugin Product Slider Pro per WooCommerce Backdoor RCE Analisi tecnica approfondita: vulnerabilità backdoor di Product Slider Pro Base e causa della vulnerabilità CWE-1284 L'origine tecnica della vulnerabilità è classificata come CWE-1284: "Convalida impropri...

CVE-2022-4047

CVE-2022-4047 Return Refund and Exchange For WooCommerce 4.0.9 - Caricamento Arbitrario di File Non Autenticato Utilizzo root@kitploit: @@@@@@@ @@@ @@@ @@@@@@@@ @@@@@@ @@@@@@@@ @@@@@@ @@@@@@ @@@ @@@@@@@@ @@@ @@@@@@@@ @@@@@@@@ @@@ @@@ @@@@@@@@ @@@@@@@@ @@@@@@@@@@ @@@@@@@@ @@@@@@@@ @@@@ @@@@@@@@@@...

CVE-2024-0399

CVE-2024-0399 - WooCommerce Customers Manager 29.4 - Iniezione SQL post-autenticazione Exploit Title: WooCommerce Customers Manager 29.4 - Iniezione SQL post-autenticazione Data: 2024-03-25 Autore Exploit: Ivan Spiridonov - xbz0n Software Link:...

CVE-2024-43917

CVE-2024-43917 Questo script dimostra una vulnerabilità di SQL injection trovata nel plugin TI WooCommerce Wishlist per WordPress, versioni fino alla 2.8.2 CVE-2024-43917. La vulnerabilità consente a utenti non autenticati di eseguire comandi SQL arbitrari sul database del sito web, esponendo...

CVE-2026-54807

CVE-2026-54807 CVE-2026-54807 WooCommerce Privilege Escalation ║ ║ Unauthenticated Admin Role Assignment via Reg. Form PRİV8 TOOLS AND EXPLOİT CANAL: https://t.me/+zuUQbKSrHgwyZmI0...

CVE-2024-50508

CVE-2024-50508 WooCommerce Product Design = 1.0.0 - Nicht authentifizierter beliebiger Dateidownload Beschreibung Das WooCommerce Product Design Plugin für WordPress ist in allen Versionen bis einschließlich 1.0.0 anfällig für Directory Traversal. Dadurch ist es nicht authentifizierten Angreifern...

CVE-2024-9756

🚀 Exploit di Caricamento Arbitrario di File WooCommerce CVE-2024-9756 📌 Panoramica Questo exploit sfrutta una vulnerabilità di caricamento arbitrario limitato e non autorizzato nel plugin Order Attachments for WooCommerce versioni 2.0 - 2.4.1 per WordPress. La vulnerabilità consente a utenti...

CVE-2026-18080

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 1.17.8 via the saveattachments function. This is due to missing file extension validation and missing path normalization whe...

WordPress WooCommerce Lottery plugin <= 2.2.9 - Unauthenticated Time-Based SQL Injection via 'orderby' and 'order' Parameters vulnerability

Unauthenticated Time-Based SQL Injection via 'orderby' and 'order' Parameters vulnerability discovered by h0xilo in WordPress Plugin WooCommerce Lottery versions = 2.2.9...

CVE-2026-18080

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce WordPress plugin (versions ≤ 1.17.8) is vulnerable to an unauthenticated arbitrary file upload via the CRM Email Connect IMAP attachment processing. The root cause is missing file extension validation and path normalization in the...

EUVD-2026-66408

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 1.17.8 via the saveattachments function. This is due to missing file extension validation and missing path normalization whe...

CVE-2026-3891

Pix for WooCommerce = 1.5.0 - Nicht authentifizierter beliebiger Datei-Upload CVE-2026-3891 PoC 📜 Beschreibung CVE-2026-3891 ist eine Schwachstelle für nicht authentifizierten beliebigen Datei-Upload im WordPress-Plugin Pix for WooCommerce. Das Plugin stellt einen AJAX-Endpunkt...

CVE-2026-18884

The WooCommerce Lottery plugin for WordPress is vulnerable to Time-Based SQL Injection via 'orderby' and 'order' GET Parameters in all versions up to, and including, 2.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Thi...

CVE-2026-18884 WooCommerce Lottery <= 2.2.9 - Unauthenticated Time-Based SQL Injection via 'orderby' and 'order' Parameters

The WooCommerce Lottery plugin for WordPress is vulnerable to Time-Based SQL Injection via 'orderby' and 'order' GET Parameters in all versions up to, and including, 2.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Thi...

EUVD-2026-66333

The WooCommerce Lottery plugin for WordPress is vulnerable to Time-Based SQL Injection via 'orderby' and 'order' GET Parameters in all versions up to, and including, 2.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Thi...

CVE-2026-18884

The WooCommerce Lottery plugin for WordPress (all versions up to and including 2.2.9 ) is vulnerable to unauthenticated time-based SQL injection via the orderby and order GET parameters. The root cause is insufficient escaping on user-supplied input combined with inadequate preparation of the exi...

CVE-2023-2986

CVE-2023-2986 Prova di concetto POC Versione Python di Alucard0x1 Prova di concetto per la vulnerabilità CVE-2023-2986 nel plugin 'Abandoned Cart Lite for WooCommerce' per WordPress in versione Python Crediti https://github.com/Ayantaker/CVE-2023-2986...