Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
436 results · page 1 of 9
Oct 28, 2026eCommerce Product Catalog: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-115596 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Reflected XSS.This issue affects eCommerce Product Catalog: from n/a through 3.6.4.
- Product
- eCommerce Product Catalog
- Affected
- up to 3.6.4
- What to do
- Affects up to 3.6.4. Update eCommerce Product Catalog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 28, 2026Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More: Local File InclusionCVE-2026-110185 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.31.0 via the 'image (any body field referenced by the ImageHelper node's mix tag)' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Exploitation requires that an administrator has built a webhook-triggered flow that pipes a webhook body field into an ImageHelper imageToBase64 node, and that the webhook remains in its default configuration (no bearer secret enforced, no IP allowlist set) — a legitimate and documented use case.
- Product
- Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More
- Affected
- up to 1.31.0
- What to do
- Affects up to 1.31.0. Update Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 23, 2026Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores.CVE-2026-112904 · Other software · givanz · reported by GitHubHigh 8.7
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. In versions 1.0.8.6 and prior, the nextRestore() and nextBackup() functions in the backup controller accept a file GET parameter and concatenate it directly to DIR_BACKUP without calling sanitizeFileName(). This allows an authenticated administrator to read arbitrary files on the server (via nextRestore) and write SQL dump content to arbitrary locations (via nextBackup). This is inconsistent with the sibling functions restore(), delete(), and download() which all correctly call sanitizeFileName() first. This issue has been patched via commit aa29cb0.
- Product
- Vvveb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026Music Store – WordPress eCommerce: Directory TraversalCVE-2026-115497 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.4.7 via the 'f' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires a valid purchase_id token, which any user can obtain by making a single low-cost purchase or receiving a shared download link.
- Product
- Music Store – WordPress eCommerce
- Affected
- up to 1.4.7
- What to do
- Affects up to 1.4.7. Update Music Store – WordPress eCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 22, 2026Authorization Bypass Through User-Controlled Key (CWE-639) in the cart and wishlist repositories of MarcosCamara01 Ecommerce Template allows any authenticated uCVE-2026-115453 · Websites & servers · MarcosCamara01 · reported by 4daa8cea-433a-44bd-9456-53b127fc289aHigh 7.1
Authorization Bypass Through User-Controlled Key (CWE-639) in the cart and wishlist repositories of MarcosCamara01 Ecommerce Template allows any authenticated user to delete and modify the cart and wishlist rows of any other user, because cartRepository.delete(), cartRepository.updateQuantityInternal() and wishlistRepository.delete() in src/lib/db/drizzle/repositories/ match rows by primary key alone, with no predicate on the owning user, and the per user authorization for those three operations rests on PostgreSQL row level security. The migrations run ALTER TABLE ... ENABLE ROW LEVEL SECURITY and create policies comparing app.current_user_id() with user_id, but never ALTER TABLE ... FORCE ROW LEVEL SECURITY, and PostgreSQL does not apply policies to the role that owns a table. The template uses one DATABASE_URL both to run the migrations, which create the tables, and for the application at runtime, so the application connects as the owner of the tables and the policies do not apply to it. cart_items.id and wishlist.id are sequential bigserial values, so the identifiers of rows belonging to other users can be enumerated, and the update path returns the modified row, which carries
- Product
- Ecommerce Template
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and checkout flow of MarcosCamara01 Ecommerce Template allows an authenticated user wiCVE-2026-115450 · Websites & servers · MarcosCamara01 · reported by 4daa8cea-433a-44bd-9456-53b127fc289aHigh 7.1
External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and checkout flow of MarcosCamara01 Ecommerce Template allows an authenticated user with no special privileges to be charged the price of one product while placing an order for another, because POST /api/user/cart accepts variantId, which determines what the order records, and stripeId, which determines what Stripe charges, as two independent fields of the request body, stores both on the cart row, and no check requires the stripeId to be the one that belongs to the variantId. POST /api/stripe/payment builds the Stripe Checkout line items from the stored value, as { price: item.stripeId, quantity }, so the amount charged is the amount of that Stripe price. The checkout.session.completed webhook then creates the order products from the variantId of the same cart row, so the order records a product that was not paid for. Every stripeId in the catalogue is readable by any visitor, so no value has to be guessed. This results in orders for goods at the price of the cheapest item in the catalogue, repeatable without limit, and in order records whose amount does not correspond to the product they list.
- Product
- Ecommerce Template
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026i-Netsolution Readymade Unilevel Ecommerce MLM (2024-03-15 build) contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate daCVE-2024-58393 · Websites & servers · i-Netsolution · reported by VulnCheckHigh 8.8
i-Netsolution Readymade Unilevel Ecommerce MLM (2024-03-15 build) contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries through the 'id' parameter. Attackers can send GET requests to /product-details.php with boolean-based, stacked, or time-based SLEEP payloads in 'id' to extract database information. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-09-14.
- Product
- Readymade Unilevel Ecommerce MLM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comi-netsolution.com
Oct 22, 2026FluentCart A New Era of eCommerce: Does not verify that a stored customer address selected during checkout belongs to the requesterCVE-2026-100142 · WordPress plugins & themes · reported by WPScanMedium 5.3
The FluentCart A New Era of eCommerce WordPress plugin before 2.2.0 does not verify that a stored customer address selected during checkout belongs to the requester, allowing unauthenticated attackers to attach any customer's stored address to an order they place and read it back, disclosing customers' postal addresses, phone numbers and company details.
- Product
- FluentCart A New Era of eCommerce
- Fixed in
- 2.2.0
- What to do
- Update FluentCart A New Era of eCommerce to 2.2.0 or newer.
Oct 16, 2026SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments: Stored Cross-Site ScriptingCVE-2026-109224 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.9.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful execution requires the affected comment to appear on a post that loads the surecart-components runtime (e.g. via a [sc_buy_button] shortcode) and contains no sc-checkout element, as these conditions trigger the innerHTML sink in sc-cart-loader.
- Product
- SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
- Affected
- up to 4.9.4
- What to do
- Affects up to 4.9.4. Update SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 16, 2026FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler: Insecure Direct Object ReferenceCVE-2026-103525 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.7.0 via the 'order_id + billing_address_id (also shipping_address_id)' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read and exfiltrate another customer's stored billing and shipping address PII — including street address, city, state, postcode, phone number, company name, VAT number, and legal registration ID — by enumerating sequential AUTO_INCREMENT order and address ID pairs. The id-equality guard intended to restrict address reuse is bypassed because the attacker controls both halves of the compared pair, and the unauthenticated AJAX entry point imposes only a soft rate limit of 5 requests per 60 seconds rather than any authentication or ownership check.
- Product
- FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler
- Affected
- up to 1.7.0
- What to do
- Affects up to 1.7.0. Update FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 16, 2026FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler: Generic SQL InjectionCVE-2026-103518 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to generic SQL Injection via the 'products[*].variants[*].<attacker-chosen key>' parameter in all versions up to, and including, 1.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. On FluentCart Pro installs, non-administrator users assigned the Manager shop role also hold the products/edit permission and are therefore able to exploit this vulnerability without administrator-level access.
- Product
- FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler
- Affected
- up to 1.7.0
- What to do
- Affects up to 1.7.0. Update FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 14, 2026SQL Injection (CWE-89) in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAlliance eCommerce [VERSION — missing] allows an unauCVE-2026-108065 · Websites & servers · Channel Software · reported by cve@rapid7.comCritical 9.8
SQL Injection (CWE-89) in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAlliance eCommerce [VERSION — missing] allows an unauthenticated remote attacker to read, write, and potentially execute commands on the backend Microsoft SQL Server via a crafted sUserID parameter value containing a single quote and stacked SQL query.
- Product
- WebAlliance eCommerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026Easy Digital Downloads – eCommerce Payments and Subscriptions made easy: Stored Cross-Site ScriptingCVE-2026-14335 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PayPal IPN Parameters in all versions up to, and including, 3.6.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
- Affected
- up to 3.6.9
- What to do
- Affects up to 3.6.9. Update Easy Digital Downloads – eCommerce Payments and Subscriptions made easy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 9, 2026Reflected Cross-Site Scripting (XSS) on the BeeTienda e-commerce platform, specifically in the latest demo version.CVE-2026-4264 · Websites & servers · BeeTienda · reported by cve-coordination@incibe.esMedium 5.1
Reflected Cross-Site Scripting (XSS) on the BeeTienda e-commerce platform, specifically in the latest demo version. The incident occurs due to a lack of proper sanitization of user input data in the 'search' parameter of the product list endpoint. When malicious payloads are transmitted via the 'search' parameter, they are displayed insecurely in the HTML response, allowing for the arbitrary execution of JavaScript code in the victim's browser.
- Product
- eCommerce Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce <= 1.1.2606090 versions.CVE-2026-32578 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce <= 1.1.2606090 versions.
- Affected
- up to 1.1.2606090
- What to do
- Affects up to 1.1.2606090. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026eCommerce Product Catalog: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105056 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Stored XSS.This issue affects eCommerce Product Catalog: from n/a through 3.6.2.
- Product
- eCommerce Product Catalog
- Affected
- up to 3.6.2
- What to do
- Affects up to 3.6.2. Update eCommerce Product Catalog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 3, 2026Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Reflected Cross-Site ScriptingCVE-2026-92551 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via ppress_billing_address Filename Parameter in all versions up to, and including, 4.17.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability is exploitable via any page hosting the ProfilePress Tabbed Widget by supplying a malicious filename for the ppress_billing_address file upload field in a crafted POST request.
- Product
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
- Affected
- up to 4.17.4
- What to do
- Affects up to 4.17.4. Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpastebin.complugins.trac.wordpress.org
Oct 3, 2026Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Sensitive Information ExposureCVE-2026-92536 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.17.4 via the get_user_profile_structure. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract other users' email addresses, login names, and registration dates via the Member Directory's per-row user rebinding when attacker-controlled base64 payloads in the [pp-custom-html] shortcode invoke [profile-email], [profile-username], and [profile-date-registered]. When the WordPress users_can_register option is enabled, unauthenticated attackers can also exploit this vulnerability by supplying the split shortcode fragments through the plugin's own registration handler, which processes the reg_nickname and reg_bio fields without a nonce requirement.
- Product
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
- Affected
- up to 4.17.4
- What to do
- Affects up to 4.17.4. Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 1, 2026Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores.CVE-2026-55232 · Other software · givanz · reported by GitHubHigh 7.6
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb's SSRF guard resolves a host with an IPv4-only function and never inspects IPv6, so any host that lacks an A record passes a private-range check. Editor oEmbed proxy fetches an attacker-supplied URL server side and reflects a response body, so an authenticated admin-panel user (default role site_admin or higher) can read internal-only services and cloud metadata, including IAM credentials, using an IPv6 literal or a domain that carries only an AAAA record. This issue has been patched in version 1.0.8.6.
- Product
- Vvveb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2026Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores.CVE-2026-55231 · Other software · givanz · reported by GitHubHigh 7.2
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, a flawed central path sanitizer lets an authenticated admin-panel user who holds backup access (default role site_admin or higher) read and delete arbitrary files on a server. An attacker can recover database credentials from config/db.php, read host files such as /etc/passwd, and delete config/db.php to push a site back into install mode for a full takeover. This issue has been patched in version 1.0.8.6.
- Product
- Vvveb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2026Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores.CVE-2026-55230 · Other software · givanz · reported by GitHubHigh 8.7
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb's HTML sanitizer fails to strip event-handler attributes when a tag carries a greater-than character inside a quoted attribute value. A low-privilege content author (default role author or contributor) can store a payload in post or product content that runs JavaScript in a browser of every visitor and of any administrator who views or previews that content, which opens a path to admin account takeover. This issue has been patched in version 1.0.8.6.
- Product
- Vvveb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026Subscriber Broken Access Control in MakeCommerce for WooCommerce <= 4.1.0 versions.CVE-2026-96817 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Subscriber Broken Access Control in MakeCommerce for WooCommerce <= 4.1.0 versions.
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions.CVE-2026-96344 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions.
- Affected
- up to 3.6.0
- What to do
- Affects up to 3.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026FluentCart A New Era of eCommerce: Does not verify that the person placing a guest checkout controls the email address suppliedCVE-2026-100143 · WordPress plugins & themes · reported by WPScanMedium 6.5
The FluentCart A New Era of eCommerce WordPress plugin before 1.6.5 does not verify that the person placing a guest checkout controls the email address supplied, allowing unauthenticated attackers who know an existing guest customer's email to obtain a logged-in account bearing that address together with the customer's stored record.
- Product
- FluentCart A New Era of eCommerce
- Fixed in
- 1.6.5
- What to do
- Update FluentCart A New Era of eCommerce to 1.6.5 or newer.
Sep 28, 2026Missing Authentication for Critical Function (CWE-306) in the product cache revalidation Server Action (src/app/actions.ts, revalidateProducts) in MarcosCamara0CVE-2026-91154 · Websites & servers · MarcosCamara01 · reported by 4daa8cea-433a-44bd-9456-53b127fc289aMedium 6.9
Missing Authentication for Critical Function (CWE-306) in the product cache revalidation Server Action (src/app/actions.ts, revalidateProducts) in MarcosCamara01 Ecommerce Template before commit ec97209 allows a remote, unauthenticated attacker to force expiration of the entire storefront product cache at will. The file declares "use server" at file scope, so every exported function compiles into a POST-invokable Server Action; revalidateProducts calls updateTag("products") with no session or role check, unlike the read-only actions in the same file which are safe by construction. Two client components under src/components/admin import the function, which causes its Server Action id to be compiled into a public /_next/static chunk that the application's admin middleware (proxy.ts) does not gate, so any unauthenticated user can extract that id from the public bundle and invoke the action directly. With cacheComponents enabled, the entire storefront (home, categories, product pages, search) is served from "use cache" entries produced by getAllProducts, getCategoryProducts and getProduct, all tagged products with an hours-long cacheLife. Repeated unauthenticated invocation of revalida
- Product
- Ecommerce Template
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate request-controlled identifiers and administrCVE-2026-96600 · Other software · isotope · reported by VulnCheckHigh 7
Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate request-controlled identifiers and administrator-supplied values directly into SQL statements. Authenticated Contao backend users with Isotope module permissions can exploit conditional and time-based injection payloads to extract arbitrary database contents including user password hashes from the tl_user table.
- Product
- isotope-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026Isotope eCommerce through 2.9.10 derives order identifiers from uniqid() instead of a cryptographically secure source, allowing unauthenticated attackers to gueCVE-2026-96599 · Other software · isotope · reported by VulnCheckHigh 8.2
Isotope eCommerce through 2.9.10 derives order identifiers from uniqid() instead of a cryptographically secure source, allowing unauthenticated attackers to guess identifiers. Guest orders lack ownership verification, enabling attackers to access order details including billing address, customer information, and purchased files by supplying a guessed uid parameter.
- Product
- isotope-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2026Datalogics Ecommerce Delivery – Datalogics: Authorization bypassCVE-2026-9613 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Datalogics Ecommerce Delivery – Datalogics plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.65. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create and cancel real shipping orders through the external logistics API using the store's stored authentication token, modify arbitrary WooCommerce order post meta on any order, overwrite the plugin's stored API token, and trigger shipping notification emails to customers.
- Product
- Datalogics Ecommerce Delivery – Datalogics
- Affected
- up to 2.6.65
- What to do
- Affects up to 2.6.65. Update Datalogics Ecommerce Delivery – Datalogics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 19, 2026Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Arbitrary shortcode executionCVE-2026-85658 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.17.2 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes.
- Product
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
- Affected
- up to 4.17.2
- What to do
- Affects up to 4.17.2. Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 19, 2026Ibtana – Ecommerce Product Addons: Unauthorized post meta modificationCVE-2026-1984 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Ibtana – Ecommerce Product Addons plugin for WordPress is vulnerable to unauthorized post meta modification due to a missing capability check on the 'iepa_use_gt_editor' AJAX action in all versions up to, and including, 0.4.7.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update or delete arbitrary post meta entries via the 'iepa_builder' meta key.
- Product
- Ibtana – Ecommerce Product Addons
- Affected
- up to 0.4.7.7
- What to do
- Affects up to 0.4.7.7. Update Ibtana – Ecommerce Product Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 17, 2026CubeCart is an ecommerce software solution.CVE-2026-54648 · Other software · cubecart · reported by GitHubMedium 6.5
CubeCart is an ecommerce software solution. Prior to 6.7.5, the GDPR tools in admin/sources/customers.gdpr.inc.php rely on page-level CC_PERM_READ access and do not require CC_PERM_DELETE for the purge, no_order_purge, or delete_guests commands. An authenticated administrator with read-only customer privileges can invoke these backend actions directly to bypass interface restrictions and irreversibly delete customer records, accounts without orders, or guest accounts, compromising data integrity and availability. This issue is fixed in version 6.7.5.
- Product
- v6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026CubeCart is an ecommerce software solution.CVE-2026-54647 · Other software · cubecart · reported by GitHubHigh 7.2
CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/settings.index.inc.php directly concatenates the administrator-controlled download_expire POST parameter into a raw UPDATE statement for CubeCart_downloads without numeric validation. An authenticated administrator can supply a comma-delimited value that changes the SET clause because HTML sanitization does not neutralize SQL syntax, allowing manipulation of database columns and potentially other data within the application's database privileges. This issue is fixed in version 6.7.5.
- Product
- v6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026CubeCart is an ecommerce software solution.CVE-2026-54646 · Other software · cubecart · reported by GitHubHigh 7.2
CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablename values into ALTER TABLE, CHECK TABLE, and ANALYZE TABLE statements without validating the identifiers or escaping embedded backticks. An authenticated administrator can terminate the quoted identifier with a closing backtick and introduce attacker-controlled structural SQL, potentially compromising database confidentiality, integrity, and availability within the application's database privileges. This issue is fixed in version 6.7.5.
- Product
- v6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026CubeCart is an ecommerce software solution.CVE-2026-54645 · Other software · cubecart · reported by GitHubMedium 4.8
CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/products.index.inc.php reads the description, description_short, and spec_copy rich-text fields from $GLOBALS['RAW']['POST'] and removes only script elements before the values are stored and rendered through Smarty templates. An administrator with product-editing rights can store event-handler attributes, SVG content, or javascript: URIs that bypass this filter, causing persistent JavaScript execution when a storefront visitor or another administrator views the product content and enabling session exposure or unauthorized browser-context actions. This issue is fixed in version 6.7.5.
- Product
- v6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026CubeCart is an ecommerce software solution.CVE-2026-54644 · Other software · cubecart · reported by GitHubMedium 6.1
CubeCart is an ecommerce software solution. Prior to 6.7.5, the _errorMessage method in classes/gui.class.php uses strip_tags to permit anchor elements in error, information, and warning messages while retaining unsafe href values and onclick event handlers. Attacker-controlled search or input data that reaches a GUI message can carry a javascript: URI or event handler through the filter, and viewing or interacting with the rendered anchor executes JavaScript in the victim's browser session, enabling session exposure or unauthorized application actions. This issue is fixed in version 6.7.5.
- Product
- v6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026CubeCart is an ecommerce software solution.CVE-2026-54643 · Other software · cubecart · reported by GitHubMedium 5.4
CubeCart is an ecommerce software solution. Prior to 6.7.5, the delete-note handler in admin/sources/orders.index.inc.php verifies only the presence of order_id and delete-note parameters before deleting records from CubeCart_order_notes, without requiring CC_PERM_DELETE for orders. An authenticated administrator lacking order modification privileges can directly invoke the handler with valid identifiers and delete order-history notes, removing operational records and audit-trail data. This issue is fixed in version 6.7.5.
- Product
- v6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026CubeCart is an ecommerce software solution.CVE-2026-54642 · Other software · cubecart · reported by GitHubMedium 5.3
CubeCart is an ecommerce software solution. Prior to 6.7.5, the reset_id download-counter action and delete_card stored-payment-card action in admin/sources/orders.index.inc.php use state-changing GET requests and are omitted from the protection map in admin/skins/default/csrf.inc.php. A remote attacker can induce an authenticated administrator to issue one of these requests without a validated session token, causing unintended resets of electronic download usage counters or deletion of stored customer payment-card tokens. This issue is fixed in version 6.7.5.
- Product
- v6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores.CVE-2026-54613 · Other software · givanz · reported by GitHubMedium 5.4
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, getThemeFolder() in admin/controller/editor/revisions.php returns the attacker-controlled theme parameter without sanitization, and backupFolder() concatenates it beneath DIR_THEMES before editor/revisions/load or editor/revisions/delete operates on a named .html file. sanitizeBackupFileName() strips traversal characters only from the separate file parameter and does not protect the theme directory component. An authenticated user with the default Editor role and editor/* permission can submit traversal sequences that redirect file_get_contents() or unlink() to a reachable backup subdirectory outside the web root. A valid admin session and CSRF token are required, the read is limited to .html files in backup directories, and deletion additionally requires filesystem write permission. This can disclose sensitive exported site content or remove backup data. This issue is fixed in version 1.0.8.5.
- Product
- Vvveb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores.CVE-2026-54612 · Other software · givanz · reported by GitHubHigh 8.8
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. From 1.0.0 until 1.0.8.5, saveGlobalElements() in admin/controller/editor/global-trait.php concatenates the attacker-controlled file portion of data-v-save-global to the active theme directory before loadHTMLFile() and file_put_contents() operate on it. An authenticated user with the default Editor role and editor/* permission can submit crafted HTML to module=editor/editor&action=save and traverse to an existing writable PHP file outside the theme directory. If the target is web-accessible, editor-controlled PHP content executes in the web server context; a shipped public/vadmin/index.php entrypoint can be used as an execution trampoline rather than requiring a test-only file. This can permit persistent webshell placement and compromise application confidentiality, integrity, and availability. This issue is fixed in version 1.0.8.5.
- Product
- Vvveb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores.CVE-2026-54507 · Other software · givanz · reported by GitHubHigh 8.4
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, the oEmbedProxy() handler in admin/controller/editor/editor.php accepts an attacker-controlled url parameter and passes it to getUrl(), while validateUrl() in system/functions.php checks only the hostname string and does not validate its resolved addresses. An authenticated admin-panel user with editor/* permission can invoke GET /admin/index.php?module=editor/editor&action=oEmbedProxy with a dotted hostname or normalized loopback form that resolves to a private, loopback, link-local, or reserved address, causing the server to issue an HTTP or HTTPS request and return the response body. Storefront users and anonymous visitors cannot invoke the endpoint, but no CSRF token is required because the action uses GET. This can disclose internal service responses or cloud instance metadata and associated credentials. This issue is fixed in version 1.0.8.5.
- Product
- Vvveb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores.CVE-2026-54506 · Other software · givanz · reported by GitHubHigh 7.6
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, app/controller/user/profile.php accepts the user[bio] field and passes stored content through sanitizeHTML() in system/functions.php, whose on* event-handler regular expression omits the forward-slash delimiter and whose do-while condition compares the string to itself, so forbidden nested tags are removed only once. An Author-role or higher user can submit solidus-prefixed event-handler markup or nested forbidden tags that survive sanitization. The stored bio is rendered without sufficient output encoding on /author/{username}, in the admin user-management view, and potentially in comment displays, causing attacker-controlled JavaScript to execute when unauthenticated visitors, administrators, or other users view the content. This can expose browser-session data and permit victim-context account actions, defacement, or phishing. This issue is fixed in version 1.0.8.5.
- Product
- Vvveb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets: Stored Cross-Site ScriptingCVE-2026-85575 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘shopengine_product_title_header_size’ parameter in all versions up to, and including, 4.9.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets
- Affected
- up to 4.9.5
- What to do
- Affects up to 4.9.5. Update ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 14, 2026Missing Authentication for Critical Function (CWE-306) in the checkout session lookup handler (src/app/api/stripe/checkout_sessions/route.ts), exposed at GET /aCVE-2026-90896 · Websites & servers · MarcosCamara01 · reported by 4daa8cea-433a-44bd-9456-53b127fc289aHigh 8.2
Missing Authentication for Critical Function (CWE-306) in the checkout session lookup handler (src/app/api/stripe/checkout_sessions/route.ts), exposed at GET /api/stripe/checkout_sessions, in MarcosCamara01 Ecommerce Template before commit 91e273c allows a remote, unauthenticated attacker holding a valid Stripe Checkout Session id (cs_...) to retrieve the full session object, including the buyer's name, email, phone, billing address, amount paid and internal userId, because the GET handler calls stripe.checkout.sessions.retrieve() and returns the result without checking for an authenticated session or session ownership. Sibling endpoints such as POST /api/stripe/payment already enforced authentication via auth.api.getSession(); this endpoint had no access control whatsoever. The session_id is exposed in the buyer's own browser URL after payment (success_url = /result?session_id={CHECKOUT_SESSION_ID}), so it leaks through Referer headers, analytics tools, server access logs and shared-machine browser history, resulting in disclosure of the buyer's personal data to an unauthenticated actor.
- Product
- Ecommerce Template
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026Craft Commerce is an ecommerce platform for Craft CMS.CVE-2026-55795 · Websites & servers · craftcms · reported by GitHubMedium 6.9
Craft Commerce is an ecommerce platform for Craft CMS. From 4.0.0 until 4.11.2 and 5.6.5, CartController in src/controllers/CartController.php activates its RateLimiter only when the number POST or GET parameter is supplied. An unauthenticated attacker can submit couponCode values to actionUpdateCart for the session-based cart while omitting number, preventing creation of the IP rate-limit identity and allowing unlimited automated coupon-code guessing and enumeration. This issue is fixed in versions 4.11.2 and 5.6.5.
- Product
- commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Sylius is an Open Source eCommerce Framework on Symfony.CVE-2026-53639 · Other software · Sylius · reported by GitHubMedium 6.3
Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, the `GET /api/v2/shop/payment-requests/{hash}` and `PUT /api/v2/shop/payment-requests/{hash}` endpoints look up the payment request solely by the hash from the URL. No ownership check is performed against the authenticated customer or the underlying order. An attacker who obtains a payment request hash can read the payment request and, through the `payment` IRI in the response, recover the underlying order's `tokenValue` (which itself grants access to the full order, items, addresses, customer email, totals); and/or update the payment request payload (e.g. `target_path`, `after_path`). These fields are used by the front-end controller to redirect the user after the payment, so an attacker can flip them to an attacker-controlled URL and intercept the buyer. The hash is a UUID, so it has to be obtained out-of-band (logs, shared links, referrer headers, a co-located client), but once it is known no other credential is required, neither authentication nor knowledge of the order token. The creation endpoint `POST /api/v2/shop/orders/{tokenValue}/payment-requ
- Product
- Sylius
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Sylius is an Open Source eCommerce Framework on Symfony.CVE-2026-53638 · Other software · Sylius · reported by GitHubMedium 4.3
Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, an authorization bypass vulnerability exists in the shop account API. The `PATCH /api/v2/shop/account/orders/{tokenValue}/payments/{paymentId}` endpoint, used by an authenticated shop customer to change the payment method of an order that has been placed but not yet paid (state `STATE_NEW`), does not validate that the chosen payment method is enabled for the order's channel. The equivalent checkout endpoint (`PATCH /api/v2/shop/orders/{tokenValue}/payments/{paymentId}`) correctly rejects out-of-channel payment methods with `HTTP 422`; the account endpoint silently accepts them and returns `HTTP 200`. An authenticated customer can therefore assign any globally enabled payment method to their own placed order, including methods that the store operator has explicitly excluded from that channel. The issue is fixed in versions: 2.0.18, 2.1.15, 2.2.6 and above. As a workaround, decorate the `Sylius\Bundle\ApiBundle\Changer\PaymentMethodChangerInterface` service in the application.
- Product
- Sylius
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Sylius is an Open Source eCommerce Framework on Symfony.CVE-2026-53637 · Other software · Sylius · reported by GitHubMedium 6.5
Sylius is an Open Source eCommerce Framework on Symfony. Versions 2.0.0 through 2.0.17, 2.1.0 through 2.1.14, and 2.2.0 through 2.2.5 contain an improper workflow enforcement vulnerability in the cart `FormComponent`. When an order is completed while its cart page remains open, the stale LiveComponent does not detect the order’s changed state and continues to permit cart actions, allowing an authenticated customer to modify or permanently delete an already completed order. Versions 2.0.18, 2.1.15, and 2.2.6 contain a patch. As a workaround, deployments can copy the patched `FormComponent` into the application's `src/` directory and override the `sylius_shop.twig.component.cart.form` service definition to use that class.
- Product
- Sylius
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026Shopping Cart & eCommerce Store: Generic SQL InjectionCVE-2026-17589 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to generic SQL Injection via the 'product_order' parameter in all versions up to, and including, 5.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order SQL injection: the payload is written to the ec_pageoption table via the ec_ajax_save_page_options handler — which applies no sanitization to raw $_POST values — and is later retrieved with stripslashes() (bypassing WordPress magic-quotes protection) before being concatenated directly into SQL on every store page render.
- Product
- Shopping Cart & eCommerce Store
- Affected
- up to 5.9.2
- What to do
- Affects up to 5.9.2. Update Shopping Cart & eCommerce Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 25, 2026eCommerce Product Catalog: Stored Cross-Site ScriptingCVE-2026-76128 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload bypasses WordPress's save-time wp_kses_post sanitization because the malicious content is stored inside shortcode brackets with no HTML tags; the tainted HTML output is only generated at render time by the shortcode handler.
- Product
- eCommerce Product Catalog
- Affected
- up to 3.5.10
- What to do
- Affects up to 3.5.10. Update eCommerce Product Catalog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 18, 2026Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores.CVE-2026-49228 · Other software · givanz · reported by GitHubHigh 8.8
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product operations allow a low-privileged Vendor to access products owned by another Vendor. The admin/controller/product/products.php controller accepts a caller-controlled product_id for duplicate and delete actions, and admin/sql/sqlite/product.sql loads and mutates products without consistently applying the current admin_id when view_other_products or edit_other_products is absent. An attacker can read product details, duplicate products, or delete products and related catalog data, exposing commercial information and causing unauthorized copies, catalog pollution, data loss, or business disruption. This issue is fixed in version 1.0.8.4.
- Product
- Vvveb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.