Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Medium5.3The Sifalo Pay WordPress plugin before 2.5.3 does not verify that a payment transaction identifier belongs to the order it is confirming, nor that the requester owns t…EPSS 0.2%Oct 14, 2026
- Medium5.3The Sifalo Pay WordPress plugin before 2.5.3 does not verify ownership of, or authorisation for, the order being updated when it handles a payment return, allowing una…EPSS 0.2%Oct 14, 2026
- UnknownThe SellKit WordPress plugin before 2.8.0 does not validate a client-supplied product price when totals are recalculated during checkout, allowing unauthenticated atta…EPSS 0.2%Oct 14, 2026
- UnknownThe YITH WooCommerce Popup WordPress plugin before 1.60.0 does not check the capability of the requesting user before deleting post meta, allowing users with the Contr…EPSS 0.2%Oct 14, 2026
- UnknownThe Donation Thermometer WordPress plugin before 2.3.0 does not escape a colour value taken from a shortcode attribute before using it in an attribute of the generated…EPSS 0.2%Oct 14, 2026
- UnknownThe Robokassa payment gateway for Woocommerce WordPress plugin before 1.9.0 does not verify the authenticity of an incoming payment-notification request before acting…EPSS 0.2%Oct 14, 2026
- UnknownThe Tainacan WordPress plugin before 1.4.0 does not restrict its reports REST endpoints to users with a management capability, allowing any authenticated subscriber to…EPSS 0.2%Oct 14, 2026
- Critical9.4A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary SQL st…EPSS 0.5%Oct 14, 2026
- UnknownThe Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthent…EPSS 0.2%Oct 14, 2026
- Medium4.3The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.14 does not verify that a user owns or may write to the album an upload is assigned to, a…EPSS 0.2%Oct 14, 2026
- Medium5.3The Asaas Gateway for WooCommerce WordPress plugin before 2.7.8 does not properly authenticate its payment webhook, accepting an empty access token in its default conf…EPSS 0.2%Oct 14, 2026
- Medium5.3The Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2 does not perform a nonce or capabil…EPSS 0.2%Oct 14, 2026
- Medium6.5The Trust Payments Gateway for WooCommerce WordPress plugin before 3.1.0 does not verify the authenticity of the payment provider's response when a customer returns fr…EPSS 0.2%Oct 14, 2026
- High8.8The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values on storage, nor escape them before outputting them on the form submissions screen in th…EPSS 0.2%Oct 14, 2026
- Medium6.8The Pricing Table WordPress plugin before 2.1.5 does not validate the scheme of a user-supplied link value in one of its blocks before rendering it, allowing users wit…EPSS 0.2%Oct 14, 2026
- High7.2The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles a…EPSS 0.2%Oct 14, 2026
- Medium4.1The FV Flowplayer Video Player WordPress plugin before 7.5.55.7212 does not properly validate a user-supplied URL before performing a server-side fetch, and an existin…EPSS 0.2%Oct 14, 2026
- Medium5.3The EmbedPress WordPress plugin before 4.6.8 does not perform any capability or nonce check on an unauthenticated request that triggers a server-side, credential-beari…EPSS 0.2%Oct 14, 2026
- Medium5.3Tronclass developed by WisdomGarden has a Sensitive Data Exposure vulnerability.EPSS 0.3%Oct 14, 2026
- Medium5.3Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability.EPSS 0.3%Oct 14, 2026
- Medium5.3The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is permitted to access a restricted gallery before accepting comment submissions…EPSS 0.1%Oct 14, 2026
- UnknownThe WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's two-factor authentication configuration, allowing a…EPSS 0.2%Oct 14, 2026
- Medium6.5The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability or nonce check on one of the handlers that drives its SSL certificate-provisioning rout…EPSS 0.1%Oct 14, 2026
- Critical10.0The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, a…EPSS 0.2%Oct 14, 2026
- High8.6The Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file to include, allowing unauthenticated attackers to i…EPSS 0.2%Oct 14, 2026