CVE-2026-84024

The BEAR – Bulk Editor and Products Manager Professional for WooCommerce plugin (WordPress) before 1.2.2 fails to verify a CSRF nonce before saving its meta field configuration. An attacker can exploit this by tricking a logged-in administrator into visiting a crafted page, resulting in an unauth...

CVE-2026-84025

BEAR – Bulk Editor and Products Manager Professional for WooCommerce (WordPress plugin) versions before 1.2.2 are affected by an IDOR (Insecure Direct Object Reference) vulnerability. Several handlers that return product data by a user-supplied identifier fail to perform ownership checks, allowin...

CVE-2026-84023

BEAR – Bulk Editor and Products Manager Professional for WooCommerce , a WordPress plugin, is affected in versions before 1.2.2 . The vulnerability stems from the plugin's failure to verify a CSRF nonce or check user capabilities before allowing updates to taxonomy terms. An attacker can modify a...

CVE-2024-43917

CVE-2024-43917 一个概念验证，用于利用 CVE-2024-43917。基于 PatchStack 的文章。 使用方法 root@kitploit: usage: python CVE-2024-43917.py --help TI WooCommerce Wishlist WordPress plugin = 2.8.2 CVE-2024-43917 PoC positional arguments: COMMAND SQL command to execute SHAREKEY share key of the wish list optional arguments:...

CVE-2026-49777

CVE-2026-49777 CVE-2026-49777 - ShapedPlugin Product Slider Pro para WooCommerce Backdoor RCE Análisis Técnico en Profundidad: Vulnerabilidad Backdoor de Product Slider Pro Base y Causa de la Vulnerabilidad CWE-1284 El origen técnico de la vulnerabilidad se clasifica como CWE-1284: "Validación...

CVE-2024-50508

CVE-2024-50508 Woocommerce Product Design = 1.0.0 - Descarga Arbitraria de Archivos No Autenticada Descripción El plugin Woocommerce Product Design para WordPress es vulnerable a Directory Traversal en todas las versiones hasta, e incluyendo, 1.0.0. Esto permite que atacantes no autenticados lean...

CVE-2026-62136

Unauthenticated Broken Access Control in Flexible Quantity – Measurement Price Calculator for WooCommerce = 2.3.21 versions...

CVE-2026-27378

Unauthenticated Broken Access Control in Deposits and Partial Payments for WooCommerce = 3.1.0 versions...

CVE-2024-50510

CVE-2024-50510 AR Para Woocommerce = 6.2 - Subida de Archivos Arbitraria No Autenticada Descripción El plugin AR for WooCommerce para WordPress es vulnerable a subidas de archivos arbitrarias debido a la falta de validación del tipo de archivo en todas las versiones hasta la 6.2 inclusive. Esto...

CVE-2026-62136 WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.21 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Flexible Quantity – Measurement Price Calculator for WooCommerce = 2.3.21 versions...

EUVD-2026-76201

Unauthenticated Broken Access Control in Flexible Quantity – Measurement Price Calculator for WooCommerce = 2.3.21 versions...

CVE-2026-62136

CVE-2026-62136 affects the WordPress plugin Flexible Quantity – Measurement Price Calculator for WooCommerce in versions

EUVD-2026-76215

Unauthenticated Broken Access Control in Deposits and Partial Payments for WooCommerce = 3.1.0 versions...

CVE-2026-27378

Deposits and Partial Payments for WooCommerce (versions

CVE-2026-27378 WordPress Deposits and Partial Payments for WooCommerce plugin <= 3.1.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Deposits and Partial Payments for WooCommerce = 3.1.0 versions...

CVE-2026-3891

🚀 CVE-2026-3891 – Subida de Archivos no Autenticada con RCE en Pix for WooCommerce Exploit de prueba de concepto para CVE-2026-3891 – subida arbitraria de archivos no autenticada que conduce a la ejecución remota de código en el plugin de WordPress Pix for WooCommerce ≤ 1.5.0. 📖 Resumen...

WordPress Registration Form for WooCommerce plugin 1.1.0-1.1.2 - Contributor+ Privilege Escalation vulnerability

Contributor+ Privilege Escalation vulnerability discovered by Sai Praneeth Koti in WordPress Plugin Registration Form for WooCommerce versions 1.1.0-1.1.2...

CVE-2026-82215

The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before acting on them, allowing unauthenticated attackers who know the store's merchant identifier to mark arbitrary orders as paid, or to cancel...

EUVD-2026-76038

The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before acting on them, allowing unauthenticated attackers who know the store's merchant identifier to mark arbitrary orders as paid, or to cancel...

CVE-2026-82215 WC PayPay Gateway 0.5 - 0.9.3 - Unauthenticated Payment Bypass via Unverified Webhook

The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before acting on them, allowing unauthenticated attackers who know the store's merchant identifier to mark arbitrary orders as paid, or to cancel...