Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

4,172 results · page 3 of 84

Oct 15, 2026Email Customizer for WooCommerce (Pro): Remote Code ExecutionCVE-2026-81534 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9.5. This is due to insufficient authorization and input sanitization in the send_test_mail() function, which allows user-controlled PHP code to be written to executable files in the uploads directory. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary PHP code on the server, leading to full site compromise.
Product
Email Customizer for WooCommerce (Pro)
Affected
up to 3.9.5
What to do
Affects up to 3.9.5. Update Email Customizer for WooCommerce (Pro) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themehigh.com wordfence.com
Oct 15, 2026Cardinity Payment Gateway for WooCommerce: Does not properly verify the authenticity of the payment notifications it receivesCVE-2026-103324 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Cardinity Payment Gateway for WooCommerce WordPress plugin before 3.4.2 does not properly verify the authenticity of the payment notifications it receives, as the secret used to sign them is empty by default, allowing unauthenticated attackers to forge an approved-payment notification and mark arbitrary orders as paid, or force them to failed.
Product
Cardinity Payment Gateway for WooCommerce
Fixed in
3.4.2
What to do
Update Cardinity Payment Gateway for WooCommerce to 3.4.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 15, 2026Checkout Field Manager (Checkout Manager) for WooCommerce: Authorization bypassCVE-2026-17031 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.9.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary Media Library attachments.
Product
Checkout Field Manager (Checkout Manager) for WooCommerce
Affected
up to 7.9.6
What to do
Affects up to 7.9.6. Update Checkout Field Manager (Checkout Manager) for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 14, 2026Hippoo Mobile App for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-108483 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hippooo Hippoo Mobile App for WooCommerce hippoo allows Reflected XSS.This issue affects Hippoo Mobile App for WooCommerce: from n/a through 1.12.0.
Product
Hippoo Mobile App for WooCommerce
Affected
up to 1.12.0
What to do
Affects up to 1.12.0. Update Hippoo Mobile App for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 14, 2026SQL Injection (CWE-89) in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAlliance eCommerce [VERSION — missing] allows an unauCVE-2026-108065 · Websites & servers · Channel Software · reported by cve@rapid7.comCritical 9.8
SQL Injection (CWE-89) in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAlliance eCommerce [VERSION — missing] allows an unauthenticated remote attacker to read, write, and potentially execute commands on the backend Microsoft SQL Server via a crafted sUserID parameter value containing a single quote and stacked SQL query.
Product
WebAlliance eCommerce
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rapid7.com
Oct 14, 2026WPForms Lite: Does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gatewayCVE-2026-82844 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gateway, allowing unauthenticated visitors to submit paid forms without paying. The form's confirmation is delivered and its notification emails are sent even though no order exists at the payment provider and no payment is recorded.
Product
WPForms Lite
Fixed in
2.0.2.2
What to do
Update WPForms Lite to 2.0.2.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026Email Template Customizer for WooCommerce: Improper Control of Generation of Code ('Code Injection')CVE-2026-103358 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Code Injection.This issue affects Email Template Customizer for WooCommerce: from n/a through 1.3.4.
Product
Email Template Customizer for WooCommerce
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update Email Template Customizer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 14, 2026Visma Pay for WooCommerce: Does not verify the authenticity of payment gateway return requestsCVE-2026-103308 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Visma Pay for WooCommerce WordPress plugin before 1.2.2 does not verify the authenticity of payment gateway return requests, relying on a merchant secret that is empty on a store which has not entered its credentials, allowing unauthenticated attackers to mark arbitrary orders as paid and to disclose the name, email address and postal address of any order's customer.
Product
Visma Pay for WooCommerce
Fixed in
1.2.2
What to do
Update Visma Pay for WooCommerce to 1.2.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026Cart Abandonment Recovery for WooCommerce: Does not verify ownership of the email address used to select an abandoned-cart record before deleting or overwriting itCVE-2026-96900 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.1.4 does not verify ownership of the email address used to select an abandoned-cart record before deleting or overwriting it, allowing unauthenticated attackers who know a customer's email to destroy or tamper with that customer's stored abandoned-cart data.
Product
Cart Abandonment Recovery for WooCommerce
Fixed in
2.1.4
What to do
Update Cart Abandonment Recovery for WooCommerce to 2.1.4 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026Paymentfor Gateway for WooCommerce: Does not verify the authenticity of an inbound payment notification before marking an orderCVE-2026-94360 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Paymentfor Gateway for WooCommerce WordPress plugin before 1.0.6 does not verify the authenticity of an inbound payment notification before marking an order as paid, allowing unauthenticated attackers to mark orders as paid without any payment being completed.
Product
Paymentfor Gateway for WooCommerce
Fixed in
1.0.6
What to do
Update Paymentfor Gateway for WooCommerce to 1.0.6 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026YITH WooCommerce Popup: Does not check the capability of the requesting user before deleting post metaCVE-2026-92426 · WordPress plugins & themes · reported by WPScanMedium 4.9
The YITH WooCommerce Popup WordPress plugin before 1.60.0 does not check the capability of the requesting user before deleting post meta, allowing users with the Contributor role and above to delete arbitrary post meta from any post, including content owned by higher-privileged users.
Product
YITH WooCommerce Popup
Fixed in
1.60.0
What to do
Update YITH WooCommerce Popup to 1.60.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026Robokassa payment gateway for Woocommerce: Does not verify the authenticity of an incoming payment-notification request before acting on the order named in itCVE-2026-91076 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Robokassa payment gateway for Woocommerce WordPress plugin before 1.9.0 does not verify the authenticity of an incoming payment-notification request before acting on the order named in it, allowing unauthenticated attackers to force any WooCommerce order into a failed state. Order identifiers are sequential, so every order in the shop can be taken out of the fulfilment queue one request at a time.
Product
Robokassa payment gateway for Woocommerce
Fixed in
1.9.0
What to do
Update Robokassa payment gateway for Woocommerce to 1.9.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026Asaas Gateway for WooCommerce: Does not properly authenticate its payment webhookCVE-2026-87974 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Asaas Gateway for WooCommerce WordPress plugin before 2.7.8 does not properly authenticate its payment webhook, accepting an empty access token in its default configuration and not verifying that the confirmed payment corresponds to the order it marks paid, allowing unauthenticated attackers to mark arbitrary orders as paid.
Product
Asaas Gateway for WooCommerce
Fixed in
2.7.8
What to do
Update Asaas Gateway for WooCommerce to 2.7.8 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant: Does not perform a nonce or capability check on the AJAX action that registers the store with its feed service and exposeCVE-2026-87968 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2 does not perform a nonce or capability check on the AJAX action that registers the store with its feed service and exposes it to unauthenticated users, so any visitor can force the store to re-register and overwrite the Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2's stored shop secret.
Product
Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant
Fixed in
5.3.2
What to do
Update Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant to 5.3.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026Trust Payments Gateway for WooCommerce: Does not verify the authenticity of the payment provider's responseCVE-2026-87843 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Trust Payments Gateway for WooCommerce WordPress plugin before 3.1.0 does not verify the authenticity of the payment provider's response when a customer returns from the hosted payment page, nor bind that response to the targeted order or check the amount, allowing unauthenticated attackers to mark arbitrary orders as paid without any payment being made, and to retrieve order and customer details.
Product
Trust Payments Gateway for WooCommerce
Fixed in
3.1.0
What to do
Update Trust Payments Gateway for WooCommerce to 3.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026CodeAtoZ B2B Suite for WooCommerce: Does not properly restrict access to guest-submitted quotesCVE-2026-105969 · WordPress plugins & themes · reported by WPScanMedium 5.3
The CodeAtoZ B2B Suite for WooCommerce WordPress plugin before 1.6.1 does not properly restrict access to guest-submitted quotes, allowing unauthenticated users to retrieve another guest's quote, including the buyer's name, email address and requested line items, by supplying an enumerable identifier.
Product
CodeAtoZ B2B Suite for WooCommerce
Fixed in
1.6.1
What to do
Update CodeAtoZ B2B Suite for WooCommerce to 1.6.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026Walletdoc Payment Gateway for WooCommerce: Does not properly sanitize and escape user input before using it in a SQL statementCVE-2026-103307 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input before using it in a SQL statement, and verifies its payment webhook with a signing secret that is empty by default, allowing unauthenticated attackers to perform SQL injection attacks and to mark arbitrary orders as paid.
Product
Walletdoc Payment Gateway for WooCommerce
Fixed in
1.8.5
What to do
Update Walletdoc Payment Gateway for WooCommerce to 1.8.5 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026Hyyan WooCommerce Polylang Integration: SQL InjectionCVE-2026-101926 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Hyyan WooCommerce Polylang Integration plugin for WordPress is vulnerable to SQL Injection via the 'variation_ids' parameter of the 'woocommerce_remove_variations' AJAX action in versions up to, and including, 1.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Hyyan WooCommerce Polylang Integration
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update Hyyan WooCommerce Polylang Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 14, 2026JTL-Connector for WooCommerce: Arbitrary File UploadCVE-2026-87855 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.3 via the saveImage() function. This is due to the startSession() function accepting an empty jtlauth parameter as a valid credential, combined with insufficient file type validation in handleImagePush(). This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
Product
JTL-Connector for WooCommerce
Affected
up to 2.4.3
What to do
Affects up to 2.4.3. Update JTL-Connector for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 14, 2026JTL-Connector for WooCommerce: Time-based SQL InjectionCVE-2026-78193 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via 'product.push' Identity Endpoint in all versions up to, and including, 2.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injection fires during identity linking, before ProductController::push() executes, meaning exploitation succeeds even if downstream product handling would otherwise reject the request.
Product
JTL-Connector for WooCommerce
Affected
up to 2.4.3
What to do
Affects up to 2.4.3. Update JTL-Connector for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 13, 2026Abandoned Cart Pro for WooCommerce: SQL InjectionCVE-2026-97668 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the guest cart persistent meta_value in all versions up to, and including, 10.8.0 due to insufficient escaping on user supplied data and lack of sufficient preparation on the existing SQL query in the update_guest_persistent_cart() function. The abandoned_cart_info value, populated from attacker-controlled checkout fields such as the SMS consent field, is passed through stripslashes() and concatenated directly into an UPDATE statement while the adjacent SELECT and INSERT use prepared statements. This makes it possible for unauthenticated attackers to append additional SQL to the query. Because the sink is an UPDATE ... SET on the wp_usermeta table, the injection can both extract sensitive information from the database via time-based blind techniques and modify usermeta rows; it has been demonstrated to escalate an arbitrary account to administrator by writing a wp_capabilities row that shadows the legitimate one.
Product
Abandoned Cart Pro for WooCommerce
Affected
up to 10.8.0
What to do
Affects up to 10.8.0. Update Abandoned Cart Pro for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record tychesoftwares.com tychesoftwares.com
Oct 13, 2026Abandoned Cart Pro for WooCommerce: Authentication BypassCVE-2026-97657 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via Malleable Encryption and Bypassable HMAC in all versions up to, and including, 10.8.0. This is due to the use of MAC-free AES-CTR encryption for cart-recovery link tokens — where the 8-byte CTR nonce is carried inside the ciphertext blob and the encryption key is looked up using the attacker-supplied `user_email` GET parameter — combined with an HMAC nonce check in `wcap_email_track_links()` that is only enforced when the `wcap_nonce` parameter is non-empty, allowing complete bypass by omission, and an insecure direct object reference on the decrypted `abandoned_id` with no ownership verification confirming the cart belongs to the email used for decryption. This makes it possible for unauthenticated attackers who possess a single legitimate cart-recovery link (obtained from their own reminder email) to recover the keystream, forge a ciphertext that decrypts to any victim's cart ID, and trigger a call to `wp_set_auth_cookie()` for the victim user — achieving full account takeover of any user who has ever abandoned a cart, including administrators. The auto-login feature defaults to
Product
Abandoned Cart Pro for WooCommerce
Affected
up to 10.8.0
What to do
Affects up to 10.8.0. Update Abandoned Cart Pro for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record tychesoftwares.com tychesoftwares.com
Oct 13, 2026Abandoned Cart Pro for WooCommerce: Generic SQL InjectionCVE-2026-102251 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'validate' parameter in all versions up to, and including, 10.8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. AES-CTR is a malleable stream cipher, so an attacker who obtains one legitimate token by abandoning a cart with an email address they control can recover the keystream and forge a ciphertext carrying arbitrary SQL. The HMAC check added in 10.4.1 is enforced only when the wcap_nonce parameter is present, so omitting the parameter skips it entirely.
Product
Abandoned Cart Pro for WooCommerce
Affected
up to 10.8.0
What to do
Affects up to 10.8.0. Update Abandoned Cart Pro for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record tychesoftwares.com tychesoftwares.com
Oct 13, 2026The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution inCVE-2026-93388 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all versions up to, and including, 2.9.1 The nbdesigner_copy_image_from_url AJAX action is registered for logged-out callers (wp_ajax_nopriv_), and its Google Drive branch rebuilds the destination filename from the raw, attacker-supplied gapi[name] parameter — bypassing the jpg/jpeg/png/gif allow-list applied on the other branch — and writes the fetched bytes to a web-accessible directory (wp-content/uploads/nbdesigner/temp/). This makes it possible for unauthenticated attackers to write a .php file to a web-served, PHP-executing location and, by supplying their own Google Drive file and OAuth token as the content source, execute arbitrary code on the server. The required save-design nonce is handed to anonymous callers by the nbd_check_use_logged_in endpoint, so it presents no barrier.
Affected
up to 2.9.1
What to do
Affects up to 2.9.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 13, 2026Membership & User Roles for WooCommerce (Automatic Role Changer): Privilege EscalationCVE-2026-104767 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Membership & User Roles for WooCommerce (Automatic Role Changer) plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 20260828. This is due to the `maybe_add_role_to_user()` function unconditionally re-assigning every role stored in the `dfxwcrc_foreign_roles` user meta cache without verifying that each cached role is still actively assigned by the external provider — a condition made permanent by `remember_foreign_roles()`, which merges new foreign roles into the cache but never evicts roles that have since been revoked. This makes it possible for authenticated attackers with subscriber-level access and above to restore a previously revoked Administrator role to their own account, gaining full administrative control of the site, by triggering any role-assignment event such as completing a purchase for a role-mapped product. Exploitation requires Replace Roles mode to be enabled and the attacker's account to have previously received Administrator legitimately through a separate role-management mechanism while the plugin was active, so that `administrator` was written into the `dfxwcrc_foreign_roles` user meta cache before the external pro
Product
Membership & User Roles for WooCommerce (Automatic Role Changer)
Affected
up to 20260828
What to do
Affects up to 20260828. Update Membership & User Roles for WooCommerce (Automatic Role Changer) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 13, 2026Shopper is a Headless e-commerce Admin Panel.CVE-2026-56826 · Other software · shopperlabs · reported by GitHubMedium 5.4
Shopper is a Headless e-commerce Admin Panel. From 2.0.0 until 2.9.2, authenticated users who could reach the Settings pages with only access_setting could directly invoke destructive actions through the Livewire endpoint because packages/admin/src/Livewire/Components/Settings/Zones/ZoneShippingOptions.php, packages/admin/src/Livewire/Components/Settings/Zones/Detail.php, packages/admin/src/Livewire/Components/Settings/Taxes/Detail.php, and packages/admin/src/Livewire/Components/Settings/Taxes/TaxRates.php did not enforce server-side delete authorization. The actions could delete carrier options, shipping zones, tax zones, and tax rates, disrupting checkout shipping, payment-method mapping, and tax calculation. This issue is fixed in version 2.9.2.
Product
shopper
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 13, 2026Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-95631 · Websites & servers · Adobe · reported by AdobeHigh 8.7
Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Product
Adobe Commerce
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record adobe.com
Oct 13, 2026Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass.CVE-2026-95630 · Websites & servers · Adobe · reported by AdobeMedium 4.3
Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction.
Product
Adobe Commerce
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record adobe.com
Oct 13, 2026Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts iCVE-2026-92922 · Websites & servers · Adobe · reported by AdobeHigh 8.1
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
Product
Adobe Commerce
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record adobe.com
Oct 13, 2026Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts inCVE-2026-92911 · Websites & servers · Adobe · reported by AdobeHigh 8.7
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
Product
Adobe Commerce
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record adobe.com
Oct 13, 2026Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass.CVE-2026-92910 · Websites & servers · Adobe · reported by AdobeHigh 7.2
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction. Scope is changed.
Product
Adobe Commerce
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record adobe.com
Oct 13, 2026Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-92909 · Websites & servers · Adobe · reported by AdobeCritical 9.8
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction.
Product
Adobe Commerce
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record adobe.com
Oct 13, 2026Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass.CVE-2026-92908 · Websites & servers · Adobe · reported by AdobeHigh 8.3
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, causing a limited disruption to availability. Exploitation of this issue does not require user interaction.
Product
Adobe Commerce
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record adobe.com
Oct 13, 2026Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-92464 · Websites & servers · Adobe · reported by AdobeCritical 9.1
Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Product
Adobe Commerce
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record adobe.com
Oct 13, 2026Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable CVE-2026-91013 · Websites & servers · Adobe · reported by AdobeCritical 9.3
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
Product
Adobe Commerce
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record adobe.com
Oct 13, 2026Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code executiCVE-2026-103849 · Websites & servers · Adobe · reported by AdobeCritical 10
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
Product
Adobe Commerce
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record adobe.com github.com
Oct 13, 2026Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable CVE-2026-100133 · Websites & servers · Adobe · reported by AdobeCritical 9.3
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
Product
Adobe Commerce
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record adobe.com
Oct 13, 2026Download Monitor integration for WooCommerce: Missing AuthorizationCVE-2026-109896 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Chill Download Monitor integration for WooCommerce download-monitor-integration-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Monitor integration for WooCommerce: from n/a through 1.0.3.
Product
Download Monitor integration for WooCommerce
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Download Monitor integration for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 13, 2026Client-Side Enforcement of Server-Side Security vulnerability in Divasoft Software and E-Commerce Inc.CVE-2026-13138 · Other software · Divasoft Software and E-Commerce Inc. · reported by iletisim@usom.gov.trHigh 8.6
Client-Side Enforcement of Server-Side Security vulnerability in Divasoft Software and E-Commerce Inc. Biletiva Ticketing Platform allows Manipulating State. This issue affects Biletiva Ticketing Platform: through 2026-07-23.
Product
Biletiva Ticketing Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr
Oct 13, 2026Pay for Payment for WooCommerce: Missing AuthorizationCVE-2026-108493 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Karolína Vyskočilová Pay for Payment for WooCommerce woocommerce-pay-for-payment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pay for Payment for WooCommerce: from n/a through 3.0.1.
Product
Pay for Payment for WooCommerce
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update Pay for Payment for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 13, 2026Active Products Tables for WooCommerce: Insertion of Sensitive Information Into Sent DataCVE-2026-108489 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in PluginUs.Net Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Active Products Tables for WooCommerce: from n/a through 2.1.3.
Product
Active Products Tables for WooCommerce
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update Active Products Tables for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 12, 2026SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query.CVE-2026-89113 · Websites & servers · SAP_SE · reported by cna@sap.comHigh 8.8
SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user could send specially crafted requests to affected functionality to inject arbitrary SQL commands. Successful exploitation could allow the user to read, modify or delete sensitive data from the application's database, resulting in a high impact on confidentiality, integrity and availability of the application.
Product
SAP Commerce Cloud (OOTB Code)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com url.sap
Oct 12, 2026Products Restricted Users for WooCommerce: Missing AuthorizationCVE-2026-107863 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Codection Products Restricted Users for WooCommerce woo-products-restricted-users allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Products Restricted Users for WooCommerce: from n/a through 0.7.
Product
Products Restricted Users for WooCommerce
Affected
up to 0.7
What to do
Affects up to 0.7. Update Products Restricted Users for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 12, 2026Booster Elite for WooCommerce: Insertion of Sensitive Information Into Sent DataCVE-2023-25996 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Insertion of Sensitive Information Into Sent Data vulnerability in Pluggabl LLC. Booster Elite for WooCommerce booster-elite-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Booster Elite for WooCommerce: from n/a before 8.4.0.
Product
Booster Elite for WooCommerce
Fixed in
8.4.0
What to do
Update Booster Elite for WooCommerce to 8.4.0 or newer.
Full record and what to do →NVD record patchstack.com
Oct 12, 2026Flexible Quantity – Measurement Price Calculator for WooCommerce: Improper Validation of Specified Quantity in InputCVE-2026-106605 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Validation of Specified Quantity in Input vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Input Data Manipulation.This issue affects Flexible Quantity – Measurement Price Calculator for WooCommerce: from n/a through 2.3.22.
Product
Flexible Quantity – Measurement Price Calculator for WooCommerce
Affected
up to 2.3.22
What to do
Affects up to 2.3.22. Update Flexible Quantity – Measurement Price Calculator for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 11, 2026Veeqo for WooCommerce: Does not restrict who can trigger its remote bridge-installation process or validate the URL it is given before downloading and extracting itCVE-2026-93550 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Veeqo for WooCommerce WordPress plugin through 2.2.8 does not restrict who can trigger its remote bridge-installation process or validate the URL it is given before downloading and extracting it, allowing users with Subscriber-level access and above to make the Veeqo for WooCommerce WordPress plugin through 2.2.8 download and extract an attacker-controlled archive containing arbitrary PHP files into the WordPress root.
Product
Veeqo for WooCommerce
Affected
up to 2.2.8
What to do
Affects up to 2.2.8. Update Veeqo for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026Fundiin cho WooCommerce: Does not have proper authorisation on several of its REST API routesCVE-2026-81649 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on several of its REST API routes, relying instead on a credential that is identical on every installation, allowing unauthenticated attackers to disclose the store's payment credentials and customer order data, overwrite the payment gateway configuration so that payments are credited elsewhere, and mark unpaid orders as paid. The same missing authorisation also allows arbitrary script to be stored in a field which is output unescaped on the classic checkout, leading to unauthenticated stored XSS on stores that do not use the block-based checkout.
Product
Fundiin cho WooCommerce
Affected
up to 3.4.0
What to do
Affects up to 3.4.0. Update Fundiin cho WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026WooCommerce Bookings: Does not limit a user-supplied value before using it to allocate memory in one of its unauthenticated AJAX actionsCVE-2026-14854 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before using it to allocate memory in one of its unauthenticated AJAX actions, allowing unauthenticated attackers to exhaust server memory and cause a Denial of Service with a single request.
Product
WooCommerce Bookings
Fixed in
3.11.0
What to do
Update WooCommerce Bookings to 3.11.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026Dokan: AI Powered WooCommerce Multivendor Marketplace Solution: Does not verify that the vendor a commission calculation is requested for is the requesting vendorCVE-2026-107694 · WordPress plugins & themes · reported by WPScanLow 2.7
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.2.0 does not verify that the vendor a commission calculation is requested for is the requesting vendor, allowing vendors to disclose the commission rate and fixed fee the marketplace administrator configured for other vendors.
Product
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution
Fixed in
5.2.0
What to do
Update Dokan: AI Powered WooCommerce Multivendor Marketplace Solution to 5.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 10, 2026YITH WooCommerce Product Add-Ons: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-66480 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Product Add-Ons allows Retrieve Embedded Sensitive Data. This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.34.0.
Product
YITH WooCommerce Product Add-Ons
Affected
up to 4.34.0
What to do
Affects up to 4.34.0. Update YITH WooCommerce Product Add-Ons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.