CVE-2026-75971

The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin is vulnerable to privilege escalation in versions up to and including 4.9.4 . The root cause is the rum_importer() function registered on the import_start action hook without a plugin-owned capability check or allowlist filtering...

CVE-2021-4347

The function updateshipmentstatusemailstatusfun in the plugin Advanced Shipment Tracking for WooCommerce in versions up to 3.2.6 is vulnerable to authenticated arbitrary options update. The function allows attackers including those at customer level to update any WordPress option in the database...

CVE-2021-4347

Summary: The WordPress plugin Advanced Shipment Tracking for WooCommerce (versions up to 3.2.6) is vulnerable due to the function update_shipment_status_email_status_fun , which allows authenticated attackers (including at customer level) to update any WordPress option in the database. The issue ...

PT-2017-6341

Name of the Vulnerable Software and Affected Versions WordPress download manager plugin versions prior to 2.7.3 Description The issue allows remote authenticated users to update every WordPress option due to a problem in the basic settings function of the download manager plugin. Recommendations...

PT-2017-6682

Name of the Vulnerable Software and Affected Versions Slideshow plugin versions 2.2.8 through 2.2.21 Description The issue allows remote attackers to read arbitrary Wordpress option values due to a problem in the SlideshowPluginSlideshowStylesheet::loadStylesheetByAJAX function. Recommendations F...