Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,038 results · page 10 of 41
Jul 30, 2025A PHAR deserialization vulnerability in the _getHeaders function of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a crafted POST request.CVE-2025-25692 · Websites & servers · reported by MITREMedium 6.5
A PHAR deserialization vulnerability in the _getHeaders function of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a crafted POST request.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2025A PHAR deserialization vulnerability in the component /themes/import of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a crafted POST request.CVE-2025-25691 · Websites & servers · reported by MITREMedium 6.5
A PHAR deserialization vulnerability in the component /themes/import of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a crafted POST request.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2025A SQL Injection vulnerability exists in the action.php endpoint of PuneethReddyHC Online Shopping System Advanced 1.0 due to improper sanitization of user-supplCVE-2025-51970 · Other software · Puneethreddyhc · reported by MITREHigh 7.7
A SQL Injection vulnerability exists in the action.php endpoint of PuneethReddyHC Online Shopping System Advanced 1.0 due to improper sanitization of user-supplied input in the keyword POST parameter.
- Product
- Online Shopping System Advanced
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jul 27, 2025A vulnerability, which was classified as problematic, was found in jerryshensjf JPACookieShop 蛋糕商城JPA版 up to 24a15c02b4f75042c9f7f615a3fed2ec1cefb999.CVE-2025-8223 · Other software · jerryshensjf · reported by VulDBLow 2.1
A vulnerability, which was classified as problematic, was found in jerryshensjf JPACookieShop 蛋糕商城JPA版 up to 24a15c02b4f75042c9f7f615a3fed2ec1cefb999. This affects an unknown part of the file AdminTypeCustController.java. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.
- Product
- JPACookieShop 蛋糕商城JPA版
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2025A vulnerability, which was classified as problematic, has been found in jerryshensjf JPACookieShop 蛋糕商城JPA版 up to 24a15c02b4f75042c9f7f615a3fed2ec1cefb999.CVE-2025-8222 · Other software · jerryshensjf · reported by VulDBLow 2
A vulnerability, which was classified as problematic, has been found in jerryshensjf JPACookieShop 蛋糕商城JPA版 up to 24a15c02b4f75042c9f7f615a3fed2ec1cefb999. Affected by this issue is some unknown functionality of the file GoodsController.java. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. Multiple endpoints are affected.
- Product
- JPACookieShop 蛋糕商城JPA版
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2025A vulnerability classified as problematic was found in jerryshensjf JPACookieShop 蛋糕商城JPA版 up to 24a15c02b4f75042c9f7f615a3fed2ec1cefb999.CVE-2025-8221 · Other software · jerryshensjf · reported by VulDBLow 2.1
A vulnerability classified as problematic was found in jerryshensjf JPACookieShop 蛋糕商城JPA版 up to 24a15c02b4f75042c9f7f615a3fed2ec1cefb999. Affected by this vulnerability is the function goodsSearch of the file GoodsCustController.java. The manipulation of the argument keyword leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
- Product
- JPACookieShop 蛋糕商城JPA版
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2025Omnishop: Unauthenticated Registration BypassCVE-2025-6215 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Omnishop plugin for WordPress is vulnerable to Unauthenticated Registration Bypass in all versions up to, and including, 1.0.9. Its /users/register endpoint is exposed to the public (permission_callback always returns true) and invokes wp_create_user() unconditionally, ignoring the site’s users_can_register option and any nonce or CAPTCHA checks. This makes it possible for unauthenticated attackers to create arbitrary user accounts (customer) on sites where registrations should be closed.
- Product
- Omnishop
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Omnishop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Jul 22, 2025Omnishop: Cross-Site Request Forgery on its /users/delete REST routeCVE-2025-6214 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Omnishop plugin for WordPress is vulnerable to Cross-Site Request Forgery on its /users/delete REST route in all versions up to, and including, 1.0.9. The route’s permission_callback only verifies that the requester is logged in, but fails to require any nonce or other proof of intent. This makes it possible for unauthenticated attackers to delete arbitrary user accounts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Omnishop
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Omnishop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Jul 21, 2025A vulnerability was found in jerryshensjf JPACookieShop 蛋糕商城JPA版 1.0.CVE-2025-7939 · Other software · jerryshensjf · reported by VulDBMedium 5.3
A vulnerability was found in jerryshensjf JPACookieShop 蛋糕商城JPA版 1.0. It has been classified as critical. Affected is the function addGoods of the file GoodsController.java. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely.
- Product
- JPACookieShop 蛋糕商城JPA版
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025A vulnerability was found in jerryshensjf JPACookieShop 蛋糕商城JPA版 1.0 and classified as critical.CVE-2025-7938 · Other software · jerryshensjf · reported by VulDBLow 2.1
A vulnerability was found in jerryshensjf JPACookieShop 蛋糕商城JPA版 1.0 and classified as critical. This issue affects the function updateGoods of the file GoodsController.java. The manipulation leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- JPACookieShop 蛋糕商城JPA版
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2025WPshop 2 – E-Commerce: Arbitrary file uploadsCVE-2015-10135 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajaxUpload function in versions before 1.3.9.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.
- Product
- WPshop 2 – E-Commerce
- Fixed in
- 1.3.9.6
- What to do
- Update WPshop 2 – E-Commerce to 1.3.9.6 or newer.
Full record and what to do →NVD recordg0blin.co.ukgithub.com
Jul 15, 2025Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart).CVE-2025-30746 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.1
Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iStore. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle iStore, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle iStore accessible data as well as unauthorized read access to a subset of Oracle iStore accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
- Product
- Oracle iStore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025The Job Iteration API is an an extension for ActiveJob that make jobs interruptible and resumable Versions prior to 1.11.0 have an arbitrary code execution vulnCVE-2025-53623 · Other software · Shopify · reported by GitHubHigh 8.1
The Job Iteration API is an an extension for ActiveJob that make jobs interruptible and resumable Versions prior to 1.11.0 have an arbitrary code execution vulnerability in the `CsvEnumerator` class. This vulnerability can be exploited by an attacker to execute arbitrary commands on the system where the application is running, potentially leading to unauthorized access, data leakage, or complete system compromise. The issue is fixed in versions `1.11.0` and above. Users can mitigate the risk by avoiding the use of untrusted input in the `CsvEnumerator` class and ensuring that any file paths are properly sanitized and validated before being passed to the class methods. Users should avoid using the `count_of_rows_in_file` method with untrusted CSV filenames.
- Product
- job-iteration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025A vulnerability was found in ShopXO up to 6.5.0 and classified as problematic.CVE-2025-7567 · Other software · reported by VulDBLow 2.1
A vulnerability was found in ShopXO up to 6.5.0 and classified as problematic. This issue affects some unknown processing of the file header.html. The manipulation of the argument lang/system_type leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 4, 2025WooCommerce Shop Page Builder: Missing AuthorizationCVE-2025-29001 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ZoomIt WooCommerce Shop Page Builder allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WooCommerce Shop Page Builder: from n/a through 2.27.7.
- Product
- WooCommerce Shop Page Builder
- Affected
- up to 2.27.7
- What to do
- Affects up to 2.27.7. Update WooCommerce Shop Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 1, 2025linjiashop <=0.9 is vulnerable to Incorrect Access Control.CVE-2025-52101 · Other software · reported by MITRECritical 9.8
linjiashop <=0.9 is vulnerable to Incorrect Access Control. When using the default-generated JWT authentication, attackers can bypass the authentication and retrieve the encrypted "password" and "salt". The password can then be obtained through brute-force cracking.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgitee.com
Jun 27, 2025Samex - Clean, Minimal Shop WooCommerce: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2023-25998 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme allows PHP Local File Inclusion. This issue affects Samex - Clean, Minimal Shop WooCommerce WordPress Theme: from n/a through 2.6.
- Product
- Samex - Clean, Minimal Shop WooCommerce
- Affected
- up to 2.6
- What to do
- Affects up to 2.6. Update Samex - Clean, Minimal Shop WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 23, 2025Innoshop through 0.4.1 allows directory traversal via FileManager API endpoints.CVE-2025-52922 · Other software · InnoShop · reported by MITREHigh 7.4
Innoshop through 0.4.1 allows directory traversal via FileManager API endpoints. An authenticated attacker with access to the admin panel could abuse this to: (1) fully map the filesystem structure via the /api/file_manager/files?base_folder= endpoint, (2) create arbitrary directories on the server via the /api/file_manager/directories endpoint, (3) read arbitrary files from the server by copying the file to a readable location within the application via the /api/file_manager/copy_files endpoint, {4) delete arbitrary files from the server via a DELETE request to /api/file_manager/files, or (5) create arbitrary files on the server by uploading them and then leveraging the /api/file_manager/move_files endpoint to move them anywhere in the filesystem.
- Product
- InnoShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2025In Innoshop through 0.4.1, an authenticated attacker could exploit the File Manager functions in the admin panel to achieve code execution on the server, by uplCVE-2025-52921 · Other software · InnoShop · reported by MITRECritical 9.9
In Innoshop through 0.4.1, an authenticated attacker could exploit the File Manager functions in the admin panel to achieve code execution on the server, by uploading a crafted file and then renaming it to have a .php extension by using the Rename Function. This bypasses the initial check that uploaded files are image files. The application relies on frontend checks to restrict the administrator from changing the extension of uploaded files to .php. This restriction is easily bypassed with any proxy tool (e.g., BurpSuite). Once the attacker renames the file, and gives it the .php extension, a GET request can be used to trigger the execution of code on the server.
- Product
- InnoShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2025Innoshop through 0.4.1 allows Insecure Direct Object Reference (IDOR) at multiple places within the frontend shop.CVE-2025-52920 · Other software · InnoShop · reported by MITREMedium 6.4
Innoshop through 0.4.1 allows Insecure Direct Object Reference (IDOR) at multiple places within the frontend shop. Anyone can create a customer account and easily exploit these. Successful exploitation results in disclosure of the PII of other customers and the deletion of their reviews of products on the website. To be specific, an attacker could view the order details of any order by browsing to /en/account/orders/_ORDER_ID_ or use the address and billing information of other customers by manipulating the shipping_address_id and billing_address_id parameters when making an order (this information is then reflected in the receipt). Additionally, an attacker could delete the reviews of other users by sending a DELETE request to /en/account/reviews/_REVIEW_ID.
- Product
- InnoShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2025Multiple SQL injection vulnerabilities in the EuroInformation MoneticoPaiement module before 1.1.1 for PrestaShop allow remote attackers to execute arbitrary SQCVE-2023-45256 · Other software · reported by MITREMedium 5.4
Multiple SQL injection vulnerabilities in the EuroInformation MoneticoPaiement module before 1.1.1 for PrestaShop allow remote attackers to execute arbitrary SQL commands via the TPE, societe, MAC, reference, or aliascb parameter to transaction.php, validation.php, or callback.php.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgmonetico-paiement.fr
Jun 9, 2025A Host Header injection vulnerability in the password reset function of VigyBag Open Source Online Shop commit 3f0e21b allows attackers to redirect victim usersCVE-2024-46452 · Other software · reported by MITREMedium 6.1
A Host Header injection vulnerability in the password reset function of VigyBag Open Source Online Shop commit 3f0e21b allows attackers to redirect victim users to a malicious site via a crafted URL.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2025External Store for Shopify: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-30999 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fahad Mahmood External Store for Shopify wp-shopify allows PHP Local File Inclusion.This issue affects External Store for Shopify: from n/a through <= 1.5.9.
- Product
- External Store for Shopify
- Affected
- up to 1.5.9
- What to do
- Affects up to 1.5.9. Update External Store for Shopify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025A vulnerability was found in zongzhige ShopXO 6.5.0.CVE-2025-5108 · Other software · zongzhige · reported by VulDBMedium 5.3
A vulnerability was found in zongzhige ShopXO 6.5.0. It has been rated as critical. This issue affects the function Upload of the file app/admin/controller/Payment.php of the component ZIP File Handler. The manipulation of the argument params leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- ShopXO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2025ejson2env allows users to decrypt EJSON secrets and export them as environment variables.CVE-2025-48069 · Other software · Shopify · reported by GitHubMedium 6.6
ejson2env allows users to decrypt EJSON secrets and export them as environment variables. Prior to version 2.0.8, the `ejson2env` tool has a vulnerability related to how it writes to `stdout`. Specifically, the tool is intended to write an export statement for environment variables and their values. However, due to inadequate output sanitization, there is a potential risk where variable names or values may include malicious content, resulting in additional unintended commands being output to `stdout`. If this output is improperly utilized in further command execution, it could lead to command injection, allowing an attacker to execute arbitrary commands on the host system. Version 2.0.8 sanitizes output during decryption. Other mitigations involve avoiding use of `ejson2env` to decrypt untrusted user secrets and/or avoiding evaluating or executing the direct output from `ejson2env` without removing nonprintable characters.
- Product
- ejson2env
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2025CiyaShop: Deserialization of Untrusted DataCVE-2025-39349 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Potenzaglobalsolutions CiyaShop ciyashop allows Object Injection.This issue affects CiyaShop: from n/a through <= 4.18.0.
- Product
- CiyaShop
- Affected
- up to 4.18.0
- What to do
- Affects up to 4.18.0. Update CiyaShop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Embed and Integrate Etsy Shop: Missing AuthorizationCVE-2025-48346 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Embed360 Embed and Integrate Etsy Shop embed-and-integrate-etsy-shop allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Embed and Integrate Etsy Shop: from n/a through <= 1.0.8.
- Product
- Embed and Integrate Etsy Shop
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Embed and Integrate Etsy Shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Real WP Shop Lite Ajax eCommerce Shopping Cart: Does not sanitise and escape some of its settingsCVE-2024-11140 · WordPress plugins & themes · reported by WPScanLow 3.5
The Real WP Shop Lite Ajax eCommerce Shopping Cart WordPress plugin through 2.0.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Real WP Shop Lite Ajax eCommerce Shopping Cart
- Affected
- up to 2.0.8
- What to do
- Affects up to 2.0.8. Update Real WP Shop Lite Ajax eCommerce Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 13, 2025Photoshop Desktop versions 26.5, 25.12.2 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code executCVE-2025-30326 · Other software · Adobe · reported by AdobeHigh 7.8
Photoshop Desktop versions 26.5, 25.12.2 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025Photoshop Desktop versions 26.5, 25.12.2 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code executiCVE-2025-30325 · Other software · Adobe · reported by AdobeHigh 7.8
Photoshop Desktop versions 26.5, 25.12.2 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025Photoshop Desktop versions 26.5, 25.12.2 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary codeCVE-2025-30324 · Other software · Adobe · reported by AdobeHigh 7.8
Photoshop Desktop versions 26.5, 25.12.2 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025An issue was discovered in OXID eShop before 7.CVE-2024-56526 · Other software · Oxid-esales · reported by MITREMedium 4.9
An issue was discovered in OXID eShop before 7. CMS pages in combination with Smarty may display user information if a CMS page contains a Smarty syntax error.
- Product
- Eshop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025WPshop 2 – E-Commerce: Insecure Direct Object ReferenceCVE-2025-3853 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 2.0.0 to 2.6.0 via the callback_generate_api_key() due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create valid API keys on behalf of other users.
- Product
- WPshop 2 – E-Commerce
- Affected
- 2.0.0 to 2.6.0
- What to do
- Affects 2.0.0 to 2.6.0. Update WPshop 2 – E-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 6, 2025WPshop 2 – E-Commerce: Privilege escalationCVE-2025-3852 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to privilege escalation via account takeover in versions 2.0.0 to 2.6.0. This is due to the plugin not properly validating a user's identity prior to updating their details like email & password through the update() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
- Product
- WPshop 2 – E-Commerce
- Affected
- 2.0.0 to 2.6.0
- What to do
- Affects 2.0.0 to 2.6.0. Update WPshop 2 – E-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 1, 2025WordPress Simple Shopping Cart: Stored Cross-Site ScriptingCVE-2025-3890 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_cart_button' shortcode in all versions up to, and including, 5.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WordPress Simple Shopping Cart
- Affected
- up to 5.1.3
- What to do
- Affects up to 5.1.3. Update WordPress Simple Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 1, 2025WordPress Simple Shopping Cart: Insecure Direct Object ReferenceCVE-2025-3889 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.3 via the 'process_payment_data' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to change the quantity of a product to a negative number, which subtracts the product cost from the total order cost. The attack will only work with Manual Checkout mode, as PayPal and Stripe will not process payments for a negative quantity.
- Product
- WordPress Simple Shopping Cart
- Affected
- up to 5.1.3
- What to do
- Affects up to 5.1.3. Update WordPress Simple Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 1, 2025WordPress Simple Shopping Cart: Insecure Direct Object ReferenceCVE-2025-3874 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.3 due to lack of randomization of a user controlled key. This makes it possible for unauthenticated attackers to access customer shopping carts and edit product links, add or delete products, and discover coupon codes.
- Product
- WordPress Simple Shopping Cart
- Affected
- up to 5.1.3
- What to do
- Affects up to 5.1.3. Update WordPress Simple Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddeveloper.wordpress.orgplugins.trac.wordpress.org
Apr 25, 2025ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor): Server-Side Request ForgeryCVE-2025-3775 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.2 via the woolentor_template_proxy function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application, and can be used to query and modify information from internal services.
- Product
- ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor)
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 23, 2025WordPress Simple Shopping Cart: Product price manipulationCVE-2025-3530 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to product price manipulation in all versions up to, and including, 5.1.2. This is due to a logic flaw involving the inconsistent use of parameters during the cart addition process. The plugin uses the parameter 'product_tmp_two' for computing a security hash against price tampering while using 'wspsc_product' to display the product, allowing an unauthenticated attacker to substitute details from a cheaper product and bypass payment for a more expensive item.
- Product
- WordPress Simple Shopping Cart
- Affected
- up to 5.1.2
- What to do
- Affects up to 5.1.2. Update WordPress Simple Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 23, 2025WordPress Simple Shopping Cart: Sensitive Information ExposureCVE-2025-3529 · WordPress plugins & themes · reported by WordfenceHigh 8.2
The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.1.2 via the 'file_url' parameter. This makes it possible for unauthenticated attackers to view potentially sensitive information and download a digital product without paying for it.
- Product
- WordPress Simple Shopping Cart
- Affected
- up to 5.1.2
- What to do
- Affects up to 5.1.2. Update WordPress Simple Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 15, 2025Shopware prior to version 6.5.8.13 is affected by a SQL injection vulnerability in the /api/search/order endpoint.CVE-2025-27892 · Other software · Shopware · reported by MITREMedium 6.8
Shopware prior to version 6.5.8.13 is affected by a SQL injection vulnerability in the /api/search/order endpoint. NOTE: this issue exists because of a CVE-2024-22406 and CVE-2024-42357 regression.
- Product
- Shopware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comredteam-pentesting.de
Apr 11, 2025Shop Products Filter: Path Traversal: '.../...//'CVE-2025-32585 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Path Traversal: '.../...//' vulnerability in Trusty Plugins Shop Products Filter trusty-woo-products-filter allows PHP Local File Inclusion.This issue affects Shop Products Filter: from n/a through <= 1.2.
- Product
- Shop Products Filter
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Shop Products Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025WP shop: Cross-Site Request Forgery (CSRF)CVE-2025-32576 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in Agence web Eoxia - Montpellier WP shop wpshop allows Upload a Web Shell to a Web Server.This issue affects WP shop: from n/a through <= 2.6.1.
- Product
- WP shop
- Affected
- up to 2.6.1
- What to do
- Affects up to 2.6.1. Update WP shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025Shopware is an open source e-commerce software platform.CVE-2025-32378 · Other software · shopware · reported by GitHubMedium 6.9
Shopware is an open source e-commerce software platform. Prior to 6.6.10.3 or 6.5.8.17, the default settings for double-opt-in allow for mass unsolicited newsletter sign-ups without confirmation. Default settings are Newsletter: Double Opt-in set to active, Newsletter: Double opt-in for registered customers set to disabled, and Log-in & sign-up: Double opt-in on sign-up set to disabled. With these settings, anyone can register an account on the shop using any e-mail-address and then check the check-box in the account page to sign up for the newsletter. The recipient will receive two mails confirming registering and signing up for the newsletter, no confirmation link needed to be clicked for either. In the backend the recipient is set to “instantly active”. This vulnerability is fixed in 6.6.10.3 or 6.5.8.17.
- Product
- shopware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025Photoshop Desktop versions 25.12.1, 26.4.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution CVE-2025-27198 · Other software · Adobe · reported by AdobeHigh 7.8
Photoshop Desktop versions 25.12.1, 26.4.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025Shopware is an open commerce platform.CVE-2025-30151 · Other software · shopware · reported by GitHubHigh 7.5
Shopware is an open commerce platform. It's possible to pass long passwords that leads to Denial Of Service via forms in Storefront forms or Store-API. This vulnerability is fixed in 6.6.10.3 or 6.5.8.17. For older versions of 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
- Product
- shopware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025Shopware 6 is an open commerce platform based on Symfony Framework and Vue.CVE-2025-30150 · Other software · shopware · reported by GitHubMedium 5.5
Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Through the store-api it is possible as a attacker to check if a specific e-mail address has an account in the shop. Using the store-api endpoint /store-api/account/recovery-password you get the response, which indicates clearly that there is no account for this customer. In contrast you get a success response if the account was found. This vulnerability is fixed in Shopware 6.6.10.3 or 6.5.8.17. For older versions of 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
- Product
- shopware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2025WebService::Xero 0.11 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic fCVE-2024-52322 · Other software · LOCALSHOP · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eMedium 5.5
WebService::Xero 0.11 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. Specifically WebService::Xero uses the Data::Random library which specifically states that it is "Useful mostly for test programs". Data::Random uses the rand() function.
- Product
- WebService::Xero
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmetacpan.orgmetacpan.org
Apr 4, 2025Display product variations dropdown on shop page: Missing AuthorizationCVE-2025-32226 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Anzar Ahmed Display product variations dropdown on shop page display-product-variations-dropdown-on-shop-page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Display product variations dropdown on shop page: from n/a through <= 1.1.3.
- Product
- Display product variations dropdown on shop page
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Display product variations dropdown on shop page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Ecwid Shopping Cart: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32195 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ecwid by Lightspeed Ecommerce Shopping Cart Ecwid Shopping Cart ecwid-shopping-cart allows Stored XSS.This issue affects Ecwid Shopping Cart: from n/a through <= 7.0.
- Product
- Ecwid Shopping Cart
- Affected
- up to 7.0
- What to do
- Affects up to 7.0. Update Ecwid Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.