Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,038 results · page 8 of 41
Feb 13, 2026Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.CVE-2026-25991 · Other software · TandoorRecipes · reported by GitHubHigh 7.7
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.5.1, there is a Blind Server-Side Request Forgery (SSRF) vulnerability in the Cookmate recipe import feature of Tandoor Recipes. The application fails to validate the destination URL after following HTTP redirects, allowing any authenticated user (including standard users without administrative privileges) to force the server to connect to arbitrary internal or external resources. The vulnerability lies in cookbook/integration/cookmate.py, within the Cookmate integration class. This vulnerability can be leveraged to scan internal network ports, access cloud instance metadata (e.g., AWS/GCP Metadata Service), or disclose the server's real IP address. This vulnerability is fixed in 2.5.1.
- Product
- recipes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2026Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.CVE-2026-25964 · Other software · TandoorRecipes · reported by GitHubMedium 4.9
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.5.1, a Path Traversal vulnerability in the RecipeImport workflow of Tandoor Recipes allows authenticated users with import permissions to read arbitrary files on the server. This vulnerability stems from a lack of input validation in the file_path parameter and insufficient checks in the Local storage backend, enabling an attacker to bypass storage directory restrictions and access sensitive system files (e.g., /etc/passwd) or application configuration files (e.g., settings.py), potentially leading to full system compromise. This vulnerability is fixed in 2.5.1.
- Product
- recipes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026EverShop is a TypeScript-first eCommerce platform.CVE-2026-25993 · Other software · evershopcommerce · reported by GitHubCritical 9.3
EverShop is a TypeScript-first eCommerce platform. During category update and deletion event handling, the application embeds path / request_path values—derived from the url_key stored in the database—into SQL statements via string concatenation and passes them to execute(). As a result, if a malicious string is stored in url_key , subsequent event processing modifies and executes the SQL statement, leading to a second-order SQL injection. Patched from v2.1.1.
- Product
- evershop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026FroshAdminer is the Adminer plugin for Shopware Platform.CVE-2026-25878 · Other software · FriendsOfShopware · reported by GitHubMedium 6.9
FroshAdminer is the Adminer plugin for Shopware Platform. Prior to 2.2.1, the Adminer route (/admin/adminer) was accessible without Shopware admin authentication. The route was configured with auth_required=false and performed no session validation, exposing the Adminer UI to unauthenticated users. This vulnerability is fixed in 2.2.1.
- Product
- FroshPlatformAdminer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026Sliver is a command and control framework that uses a custom Wireguard netstack.CVE-2026-25791 · Other software · BishopFox · reported by GitHubHigh 7.5
Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to 1.7.0, the DNS C2 listener accepts unauthenticated TOTP bootstrap messages and allocates server-side DNS sessions without validating OTP values, even when EnforceOTP is enabled. Because sessions are stored without a cleanup/expiry path in this flow, an unauthenticated remote actor can repeatedly create sessions and drive memory exhaustion. This vulnerability is fixed in 1.7.0.
- Product
- sliver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2026A security flaw has been discovered in guchengwuyue yshopmall up to 1.9.1.CVE-2026-2146 · Other software · guchengwuyue · reported by VulDBLow 2.1
A security flaw has been discovered in guchengwuyue yshopmall up to 1.9.1. This affects the function updateAvatar of the file /api/users/updateAvatar of the component co.yixiang.utils.FileUtil. Performing a manipulation of the argument File results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- yshopmall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026Sliver is a command and control framework that uses a custom Wireguard netstack.CVE-2026-25760 · Other software · BishopFox · reported by GitHubMedium 6.5
Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to 1.6.11, a path traversal in the website content subsystem lets an authenticated operator read arbitrary files on the Sliver server host. This is an authenticated path traversal / arbitrary file read issue, and it can expose credentials, configs, and keys. This vulnerability is fixed in 1.6.11.
- Product
- sliver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026PrestaShop is an open source e-commerce web application.CVE-2026-25597 · Websites & servers · reported by GitHubMedium 5.3
PrestaShop is an open source e-commerce web application. Prior to 8.2.4 and 9.0.3, there is a time-based user enumeration vulnerability in the user authentication functionality of PrestaShop. This vulnerability allows an attacker to determine whether a customer account exists in the system by measuring response times. This vulnerability is fixed in 8.2.4 and 9.0.3.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026OXID eShop versions 6.x prior to 6.3.4 contains a SQL injection vulnerability in the 'sorting' parameter that allows attackers to insert malicious database contCVE-2019-25260 · Other software · OXID-eSales · reported by VulnCheckHigh 8.8
OXID eShop versions 6.x prior to 6.3.4 contains a SQL injection vulnerability in the 'sorting' parameter that allows attackers to insert malicious database content. Attackers can exploit the vulnerability by manipulating the sorting parameter to inject PHP code into the database and execute arbitrary code through crafted URLs.
- Product
- OXID eShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.oxid-esales.comgithub.com
Feb 1, 2026Easy Cart Shopping Cart 2021 contains a non-persistent cross-site scripting vulnerability in the search module's keyword parameter.CVE-2021-47856 · Other software · NetArt Media · reported by VulnCheckMedium 5.1
Easy Cart Shopping Cart 2021 contains a non-persistent cross-site scripting vulnerability in the search module's keyword parameter. Remote attackers can inject malicious script code through the search input to compromise user sessions and manipulate application content.
- Product
- Easy Cart Shopping Cart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetartmedia.netvulncheck.com
Jan 28, 2026VidShop – Shoppable Videos for WooCommerce: Time-based SQL InjectionCVE-2026-0702 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The VidShop – Shoppable Videos for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'fields' parameter in all versions up to, and including, 1.1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- VidShop – Shoppable Videos for WooCommerce
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update VidShop – Shoppable Videos for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 23, 2026PEEL Shopping 9.3.0 contains a stored cross-site scripting vulnerability in the address parameter of the change_params.php script.CVE-2021-47897 · Other software · PEEL eCommerce · reported by VulnCheckMedium 5.1
PEEL Shopping 9.3.0 contains a stored cross-site scripting vulnerability in the address parameter of the change_params.php script. Attackers can inject malicious JavaScript payloads that execute when users interact with the address text box, potentially enabling client-side script execution.
- Product
- PEEL Shopping
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordweb.archive.orgexploit-db.com
Jan 23, 2026PEEL Shopping 9.3.0 contains a stored cross-site scripting vulnerability in the 'Comments / Special Instructions' parameter of the purchase page.CVE-2021-47892 · Other software · PEEL eCommerce · reported by VulnCheckMedium 5.1
PEEL Shopping 9.3.0 contains a stored cross-site scripting vulnerability in the 'Comments / Special Instructions' parameter of the purchase page. Attackers can inject malicious JavaScript payloads that will execute when the page is refreshed, potentially allowing client-side script execution.
- Product
- PEEL Shopping
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordweb.archive.orgexploit-db.com
Jan 23, 2026Ecwid Shopping Cart: Missing AuthorizationCVE-2026-24613 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ecwid by Lightspeed Ecommerce Shopping Cart Ecwid Shopping Cart ecwid-shopping-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ecwid Shopping Cart: from n/a through <= 7.0.6.
- Product
- Ecwid Shopping Cart
- Affected
- up to 7.0.6
- What to do
- Affects up to 7.0.6. Update Ecwid Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Ecwid Shopping Cart: Missing AuthorizationCVE-2026-24580 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Ecwid by Lightspeed Ecommerce Shopping Cart Ecwid Shopping Cart ecwid-shopping-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ecwid Shopping Cart: from n/a through <= 7.0.5.
- Product
- Ecwid Shopping Cart
- Affected
- up to 7.0.5
- What to do
- Affects up to 7.0.5. Update Ecwid Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026PawFriends - Pet Shop and Veterinary: Cross-Site Request Forgery (CSRF)CVE-2026-22382 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Mikado-Themes PawFriends - Pet Shop and Veterinary WordPress Theme pawfriends allows Cross Site Request Forgery.This issue affects PawFriends - Pet Shop and Veterinary WordPress Theme: from n/a through <= 1.3.
- Product
- PawFriends - Pet Shop and Veterinary
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update PawFriends - Pet Shop and Veterinary to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026MaxShop: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-69047 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magentech MaxShop sw_maxshop allows PHP Local File Inclusion.This issue affects MaxShop: from n/a through <= 3.6.20.
- Product
- MaxShop
- Affected
- up to 3.6.20
- What to do
- Affects up to 3.6.20. Update MaxShop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2026CoreShop is a Pimcore enhanced eCommerce solution.CVE-2026-23959 · Other software · coreshop · reported by GitHubMedium 6.9
CoreShop is a Pimcore enhanced eCommerce solution. An error-based SQL Injection vulnerability was identified in versions prior to 4.1.9 in the `CustomerTransformerController` within the CoreShop admin panel. The affected endpoint improperly interpolates user-supplied input into a SQL query, leading to database error disclosure and potential data extraction. Version 4.1.9 fixes the issue.
- Product
- CoreShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2026RepairBuddy – Repair Shop CRM & Booking Plugin for: Insecure Direct Object ReferenceCVE-2026-0820 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference due to missing capability checks on the wc_upload_and_save_signature_handler function in all versions up to, and including, 4.1116. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary signatures to any order in the system, potentially modifying order metadata and triggering unauthorized status changes.
- Product
- RepairBuddy – Repair Shop CRM & Booking Plugin for
- Affected
- up to 4.1116
- What to do
- Affects up to 4.1116. Update RepairBuddy – Repair Shop CRM & Booking Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 15, 2026Isshue Shopping Cart 3.5 contains a persistent cross-site scripting vulnerability in title input fields across stock, customer, and invoice modules.CVE-2021-47769 · Other software · Bdtask · reported by VulnCheckMedium 5.1
Isshue Shopping Cart 3.5 contains a persistent cross-site scripting vulnerability in title input fields across stock, customer, and invoice modules. Attackers with privileged user accounts can inject malicious scripts that execute on preview, potentially enabling session hijacking and persistent phishing attacks.
- Product
- Isshue Shopping Cart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbdtask.comexploit-db.com
Jan 14, 2026Shopware is an open commerce platform.CVE-2026-23498 · Other software · shopware · reported by GitHubHigh 7.2
Shopware is an open commerce platform. From 6.7.0.0 to before 6.7.6.1, a regression of CVE-2023-2017 leads to an array and array crafted PHP Closure not checked being against allow list for the map(...) override. This vulnerability is fixed in 6.7.6.1.
- Product
- shopware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2026A vulnerability has been found in jiujiujia/victor123/wxw850227 jjjfood and jjjshop_food up to 20260103.CVE-2026-0843 · Other software · jiujiujia · reported by VulDBLow 2.1
A vulnerability has been found in jiujiujia/victor123/wxw850227 jjjfood and jjjshop_food up to 20260103. This vulnerability affects unknown code of the file /index.php/api/product.category/index. Such manipulation of the argument latitude leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product is distributed under multiple different names. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- jjjfood
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record101.200.76.102vuldb.com
Jan 9, 2026A vulnerability was determined in guchengwuyue yshopmall up to 1.9.1.CVE-2025-15496 · Other software · guchengwuyue · reported by VulDBLow 2.1
A vulnerability was determined in guchengwuyue yshopmall up to 1.9.1. Affected is the function getPage of the file /api/jobs. This manipulation of the argument sort causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- yshopmall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2026Cross-Site Scripting (XSS) is present on the ctl00_Content01_fieldValue parameters on the /psp/appNet/TemplateOrder/TemplatePreview.aspx endpoint in edu BusinesCVE-2025-61550 · Other software · Edubusinesssolutions · reported by MITREMedium 5.4
Cross-Site Scripting (XSS) is present on the ctl00_Content01_fieldValue parameters on the /psp/appNet/TemplateOrder/TemplatePreview.aspx endpoint in edu Business Solutions Print Shop Pro WebDesk version 18.34 (fixed in 19.69). User-supplied input is stored and later rendered in HTML pages without proper output encoding or sanitization. This allows attackers to persistently inject arbitrary JavaScript that executes in the context of other users' sessions
- Product
- Print Shop Pro Webdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2026Cross-Site Scripting (XSS) is present on the LoginID parameter on the /PSP/app/web/reg/reg_display.asp endpoint in edu Business Solutions Print Shop Pro WebDeskCVE-2025-61549 · Other software · Edubusinesssolutions · reported by MITREMedium 6.1
Cross-Site Scripting (XSS) is present on the LoginID parameter on the /PSP/app/web/reg/reg_display.asp endpoint in edu Business Solutions Print Shop Pro WebDesk version 18.34 (fixed in 19.76). Unsanitized user input is reflected in HTTP responses without proper HTML encoding or escaping. This allows attackers to execute arbitrary JavaScript in the context of a victim s browser session
- Product
- Print Shop Pro Webdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2026SQL Injection is present on the hfInventoryDistFormID parameter in the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint in edu Business Solutions Print ShopCVE-2025-61548 · Other software · Edubusinesssolutions · reported by MITRECritical 9.8
SQL Injection is present on the hfInventoryDistFormID parameter in the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint in edu Business Solutions Print Shop Pro WebDesk version 18.34 (fixed in 19.69). Unsanitized user input is incorporated directly into SQL queries without proper parameterization or escaping. This vulnerability allows remote attackers to execute arbitrary SQL commands
- Product
- Print Shop Pro Webdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2026Cross-Site Request Forgery (CSRF) is present on all functions in edu Business Solutions Print Shop Pro WebDesk version 18.34 (fixed in 19.76).CVE-2025-61547 · Other software · Edubusinesssolutions · reported by MITREMedium 6.8
Cross-Site Request Forgery (CSRF) is present on all functions in edu Business Solutions Print Shop Pro WebDesk version 18.34 (fixed in 19.76). The application does not implement proper CSRF tokens or other other protective measures, allowing a remote attacker to trick authenticated users into unknowingly executing unintended actions within their session. This can lead to unauthorized data modification such as credential updates.
- Product
- Print Shop Pro Webdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2026There is an issue on the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint in edu Business Solutions Print Shop Pro WebDesk version 18.34 (fixed in 19.69) thCVE-2025-61546 · Other software · Edubusinesssolutions · reported by MITRECritical 9.1
There is an issue on the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint in edu Business Solutions Print Shop Pro WebDesk version 18.34 (fixed in 19.69) that enables remote attacker to create financial discrepancies by purchasing items with a negative quantity. This vulnerability is possible due to reliance on client-side input validation controls.
- Product
- Print Shop Pro Webdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2026indieka900 online-shopping-system-php 1.0 is vulnerable to SQL Injection in master/review_action.php via the proId parameter.CVE-2025-61246 · Other software · Indieka900 · reported by MITRECritical 9.8
indieka900 online-shopping-system-php 1.0 is vulnerable to SQL Injection in master/review_action.php via the proId parameter.
- Product
- Online Shopping System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2026CoreShop is a Pimcore enhanced eCommerce solution.CVE-2026-22242 · Other software · coreshop · reported by GitHubMedium 4.9
CoreShop is a Pimcore enhanced eCommerce solution. Prior to version 4.1.8, a blind SQL injection vulnerability exists in the application that allows an authenticated administrator-level user to extract database contents using boolean-based or time-based techniques. The database account used by the application is read-only and non-DBA, limiting impact to confidential data disclosure only. No data modification or service disruption is possible. This issue has been patched in version 4.1.8.
- Product
- CoreShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2026e-shops: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68890 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hands01 e-shops e-shops-cart2 allows DOM-Based XSS.This issue affects e-shops: from n/a through <= 1.0.4.
- Product
- e-shops
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update e-shops to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 8, 2026Rozy - Flower Shop: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-12549 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magentech Rozy - Flower Shop rozy allows PHP Local File Inclusion.This issue affects Rozy - Flower Shop: from n/a through <= 1.2.25.
- Product
- Rozy - Flower Shop
- Affected
- up to 1.2.25
- What to do
- Affects up to 1.2.25. Update Rozy - Flower Shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 5, 2026A Blind Server-Side Request Forgery (SSRF) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to force the server to initiate an HTTP reCVE-2025-67427 · Other software · Evershop · reported by MITREMedium 6.5
A Blind Server-Side Request Forgery (SSRF) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to force the server to initiate an HTTP request via the "GET /images" API. The vulnerability occurs due to insufficient validation of the "src" query parameter, which permits arbitrary HTTP or HTTPS URIs, resulting in unexpected requests against internal and external networks.
- Product
- Evershop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2026A Denial of Service (DoS) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaust the application server's resources via the "GET CVE-2025-67419 · Other software · Evershop · reported by MITREHigh 7.5
A Denial of Service (DoS) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaust the application server's resources via the "GET /images" API. The application fails to limit the height of the use-element shadow tree or the dimensions of pattern tiles during the processing of SVG files, resulting in unbounded resource consumption and system-wide denial of service.
- Product
- Evershop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2026Shopo: Unrestricted Upload of File with Dangerous TypeCVE-2025-31048 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Themify Shopo allows Upload a Web Shell to a Web Server.This issue affects Shopo: from n/a through 1.1.4.
- Product
- Shopo
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Shopo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 5, 2026Amazon Native Shopping Recommendations: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30633 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team Amazon Native Shopping Recommendations allows SQL Injection.This issue affects Amazon Native Shopping Recommendations: from n/a through 1.3.
- Product
- Amazon Native Shopping Recommendations
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Amazon Native Shopping Recommendations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2026ShopBuilder: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-13456 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ShopBuilder WordPress plugin before 3.2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- ShopBuilder
- Fixed in
- 3.2.2
- What to do
- Update ShopBuilder to 3.2.2 or newer.
Dec 31, 2025Live Shopping & Shoppable Videos For WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-62080 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Channelize.io Team Live Shopping & Shoppable Videos For WooCommerce live-shopping-video-streams allows Cross Site Request Forgery.This issue affects Live Shopping & Shoppable Videos For WooCommerce: from n/a through <= 2.2.0.
- Product
- Live Shopping & Shoppable Videos For WooCommerce
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update Live Shopping & Shoppable Videos For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Live Shopping & Shoppable Videos For WooCommerce: Missing AuthorizationCVE-2025-62081 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Channelize.io Team Live Shopping & Shoppable Videos For WooCommerce live-shopping-video-streams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Live Shopping & Shoppable Videos For WooCommerce: from n/a through <= 2.2.0.
- Product
- Live Shopping & Shoppable Videos For WooCommerce
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update Live Shopping & Shoppable Videos For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025ShopMagic: Missing AuthorizationCVE-2025-69093 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wpdesk ShopMagic shopmagic-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShopMagic: from n/a through <= 4.7.2.
- Product
- ShopMagic
- Affected
- up to 4.7.2
- What to do
- Affects up to 4.7.2. Update ShopMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 17, 2025Storybook is a frontend workshop for building user interface components and pages in isolation.CVE-2025-68429 · Other software · storybookjs · reported by GitHubHigh 7.3
Storybook is a frontend workshop for building user interface components and pages in isolation. A vulnerability present starting in versions 7.0.0 and prior to versions 7.6.21, 8.6.15, 9.1.17, and 10.1.10 relates to Storybook’s handling of environment variables defined in a `.env` file, which could, in specific circumstances, lead to those variables being unexpectedly bundled into the artifacts created by the `storybook build` command. When a built Storybook is published to the web, the bundle’s source is viewable, thus potentially exposing those variables to anyone with access. For a project to potentially be vulnerable to this issue, it must build the Storybook (i.e. run `storybook build` directly or indirectly) in a directory that contains a `.env` file (including variants like `.env.local`) and publish the built Storybook to the web. Storybooks built without a `.env` file at build time are not affected, including common CI-based builds where secrets are provided via platform environment variables rather than `.env` files. Storybook runtime environments (i.e. `storybook dev`) are not affected. Deployed applications that share a repo with your Storybook are not affected. Users sh
- Product
- storybook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comstorybook.js.org
Dec 12, 2025Online Shopping System Advanced 1.0 contains a SQL injection vulnerability in the payment_success.php script that allows attackers to inject malicious SQL throuCVE-2024-58316 · Other software · PuneethReddyHC · reported by VulnCheckHigh 8.7
Online Shopping System Advanced 1.0 contains a SQL injection vulnerability in the payment_success.php script that allows attackers to inject malicious SQL through the unfiltered 'cm' parameter. Attackers can exploit the vulnerability by sending crafted SQL queries to retrieve sensitive database information by manipulating the user ID parameter.
- Product
- online-shopping-system-advanced
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Dec 10, 2025Shopware is an open commerce platform.CVE-2025-67648 · Other software · shopware · reported by GitHubHigh 7.1
Shopware is an open commerce platform. Versions 6.4.6.0 through 6.6.10.9 and 6.7.0.0 through 6.7.5.0 have a Reflected XSS vulnerability in AuthController.php. A request parameter from the login page URL is directly rendered within the Twig template of the Storefront login page without further processing or input validation. This allows direct code injection into the template via the URL parameter, waitTime, which lacks proper input validation. This issue is fixed in versions 6.6.10.10 and 6.7.5.1.
- Product
- shopware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025Shopkeeper Extender: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67544 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Get Bowtied Shopkeeper Extender shopkeeper-extender allows Stored XSS.This issue affects Shopkeeper Extender: from n/a through < 7.0.
- Product
- Shopkeeper Extender
- What to do
- Update Shopkeeper Extender to the newest version.
Dec 8, 2025A vulnerability was found in Jihai Jshop MiniProgram Mall System 2.9.0.CVE-2025-14259 · Other software · Jihai · reported by VulDBLow 2.1
A vulnerability was found in Jihai Jshop MiniProgram Mall System 2.9.0. Affected by this issue is some unknown functionality of the file /index.php/api.html. The manipulation of the argument cat_id results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Jshop MiniProgram Mall System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record101.200.76.102vuldb.com
Dec 5, 2025A weakness has been identified in TrippWasTaken PHP-Guitar-Shop up to 6ce0868889617c1975982aae6df8e49555d0d555.CVE-2025-14091 · Other software · TrippWasTaken · reported by VulDBMedium 5.5
A weakness has been identified in TrippWasTaken PHP-Guitar-Shop up to 6ce0868889617c1975982aae6df8e49555d0d555. This vulnerability affects unknown code of the file /product.php of the component Product Details Page. Executing manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- PHP-Guitar-Shop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2025Torod – The smart shipping and delivery portal for e-shops and retailers: Cross-Site Request ForgeryCVE-2025-12373 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Torod – The smart shipping and delivery portal for e-shops and retailers plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9. This is due to missing or incorrect nonce validation on the save_settings function. This makes it possible for unauthenticated attackers to modify plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Torod – The smart shipping and delivery portal for e-shops and retailers
- Affected
- up to 1.9
- What to do
- Affects up to 1.9. Update Torod – The smart shipping and delivery portal for e-shops and retailers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 5, 2025Hide Categories Or Products On Shop Page: Cross-Site Request ForgeryCVE-2025-12128 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Hide Categories Or Products On Shop Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7. This is due to missing or incorrect nonce validation on the save_data_hcps() function. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Hide Categories Or Products On Shop Page
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update Hide Categories Or Products On Shop Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Dec 3, 2025ShopEngine Elementor WooCommerce Builder Addon: Cross-Site Request ForgeryCVE-2025-12358 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.8.5. This is due to missing nonce validation on the "post_add_to_list" function as well as an incorrect permissions callback in the "Api/init" function. This makes it possible for unauthenticated attackers to add or remove products from a user's wishlist via a forged request granted they can trick a site's user into performing an action such as clicking on a link.
- Product
- ShopEngine Elementor WooCommerce Builder Addon
- Affected
- up to 4.8.5
- What to do
- Affects up to 4.8.5. Update ShopEngine Elementor WooCommerce Builder Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 2, 2025EverShop 2.0.1 allows a remote unauthenticated attacker to upload arbitrary files and create directories via the /api/images endpoint.CVE-2025-65844 · Other software · Evershop · reported by MITREHigh 7.5
EverShop 2.0.1 allows a remote unauthenticated attacker to upload arbitrary files and create directories via the /api/images endpoint. The endpoint is accessible without authentication by default, and server-side validation of uploaded files is insufficient. This can be abused to upload arbitrary content (including non-image files) which could impersonate user/admin login panels (exfiltrating credentials) and to perform a denial-of-service attack by exhausting disk space.
- Product
- Evershop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.