19557 matches found
CVE-2026-16947
The Total processing card payments for WooCommerce WordPress plugin through 7.3 does not validate a user-supplied path before using it to build a server-side verification request, and does not verify the authenticity of the response, allowing unauthenticated attackers to redirect that request to ...
CVE-2026-16947 Total Processing Card Payments for WooCommerce <= 7.3 - Unauthenticated SSRF leading to Payment Bypass and Gateway Credential Disclosure
The Total processing card payments for WooCommerce WordPress plugin through 7.3 does not validate a user-supplied path before using it to build a server-side verification request, and does not verify the authenticity of the response, allowing unauthenticated attackers to redirect that request to ...
CVE-2026-16947
CVE-2026-16947 affects the Total processing card payments for WooCommerce WordPress plugin (through version 7.3 ). The plugin fails to validate a user-supplied path before using it to build a server-side verification request, and does not verify the authenticity of the response. This allows unaut...
EUVD-2026-68044
The Total processing card payments for WooCommerce WordPress plugin through 7.3 does not validate a user-supplied path before using it to build a server-side verification request, and does not verify the authenticity of the response, allowing unauthenticated attackers to redirect that request to ...
PT-2026-83396
Name of the Vulnerable Software and Affected Versions Total processing card payments for WooCommerce versions prior to 7.4 Description An issue exists where the plugin fails to validate a user-supplied path used to construct a server-side verification request and does not verify the authenticity ...
PT-2026-83497
The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.3. This is due to the plugin accepting an attacker-controlled afreg select user role value from the unauthenticated WooCommerce Store API...
CVE-2026-6176
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the aggregated review form submission in versions up to and including 5.106.0. This is due to insufficient input sanitization and output escaping on user-supplied review comment text. The...
WordPress Return Refund and Exchange For WooCommerce plugin < 4.6.4 - Unauthenticated Guest Order Message Disclosure and Manipulation vulnerability
Unauthenticated Guest Order Message Disclosure and Manipulation vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Return Refund and Exchange For WooCommerce versions 4.6.4...
WordPress Customer Reviews for WooCommerce plugin <= 5.106.0 - Unauthenticated Stored Cross-Site Scripting via Aggregated Review Form vulnerability
Unauthenticated Stored Cross-Site Scripting via Aggregated Review Form vulnerability discovered by daroo in WordPress Plugin Customer Reviews for WooCommerce versions = 5.106.0...
WordPress StoreGrowth plugin < 2.1.2 - Unauthenticated Arbitrary Price Manipulation vulnerability
Unauthenticated Arbitrary Price Manipulation vulnerability discovered by Shikhali Jamalzade in WordPress Plugin StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart versions 2.1.2...
EUVD-2026-67711
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the aggregated review form submission in versions up to and including 5.106.0. This is due to insufficient input sanitization and output escaping on user-supplied review comment text. The...
CVE-2026-6176 Customer Reviews for WooCommerce <= 5.106.0 - Unauthenticated Stored Cross-Site Scripting via Aggregated Review Form
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the aggregated review form submission in versions up to and including 5.106.0. This is due to insufficient input sanitization and output escaping on user-supplied review comment text. The...
CVE-2026-81277
Contributor SQL Injection in Suggestion Engine for WooCommerce = 2.0.11 versions...
CVE-2026-78283
Unauthenticated Cross Site Scripting XSS in Music Player for WooCommerce = 1.8.9 versions...
CVE-2026-27330
Unauthenticated Broken Access Control in Mobile App for WooCommerce = 0.4.62 versions...
CVE-2026-81277
Contributor-level SQL Injection vulnerability affects the Suggestion Engine for WooCommerce WordPress plugin in versions
EUVD-2026-66954
Contributor SQL Injection in Suggestion Engine for WooCommerce = 2.0.11 versions...
CVE-2026-81277 WordPress Suggestion Engine for WooCommerce plugin <= 2.0.11 - SQL Injection vulnerability
Contributor SQL Injection in Suggestion Engine for WooCommerce = 2.0.11 versions...