Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 52

Export CSV
CVE-2026-81543

Abandoned Cart Pro for WooCommerce <= 10.7.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.7.1. This is due to missing capability checks and nonce verification on multiple AJAX actions including wcap_save_connector_settings, wcap_send_manual_email, wcap_abandoned_cart_info, and wcap_change_manual_email_data. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify SMTP connector settings to route administrator recovery emails through an attacker-controlled server and intercept auto-login links to gain full administrative access. The plugin's auto-login feature must be enabled, which is the default configuration.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Tychesoftwares Wordpress
Products
Abandoned Cart Pro For Woocommerce Wordpress
CVE-2026-19089

Product Input Fields for WooCommerce < 2.0.2 - Unauthenticated Arbitrary File Upload

The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded file types when its accepted-types setting is left empty, which its own documentation advertises as accepting all files, allowing unauthenticated attackers to upload arbitrary files and achieve remote code execution on servers that do not honour the directory's access rules.

CVSS 3.1 · 9.8 Critical EPSS 3.2% KEV · Not listed
Vendors
Tychesoftwares Wordpress
Products
Product Input Fields For Woocommerce Wordpress
CVE-2024-10857

Product Input Fields for WooCommerce <= 1.9 - Authenticated (Contributor+) Arbitrary File Read

The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.9 via the handle_downloads() function due to insufficient file path validation/sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Tychesoftwares
Products
Product Input Fields For Woocommerce
CVE-2026-6447

Call for Price for WooCommerce <= 4.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Call for Price' Label Settings

The Call for Price for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Tychesoftwares Wordpress
Products
Call For Price For Woocommerce Wordpress
CVE-2026-25317

WordPress Print Invoice & Delivery Notes for WooCommerce plugin <= 5.9.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in tychesoftwares Print Invoice & Delivery Notes for WooCommerce woocommerce-delivery-notes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through <= 5.9.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Tychesoftwares Wordpress
Products
Print Invoice & Delivery Notes For Woocommerce Wordpress
CVE-2022-46795

WordPress Print Invoice & Delivery Notes for WooCommerce plugin <= 4.7.2 - CSRF Plugin Settings Reset vulnerability

Missing Authorization vulnerability in Tyche Softwares Print Invoice & Delivery Notes for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through 4.7.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Tychesoftwares
Products
Print Invoice \& Delivery Notes For Woocommerce
CVE-2025-69027

WordPress Product Delivery Date for WooCommerce – Lite plugin <= 3.2.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in tychesoftwares Product Delivery Date for WooCommerce – Lite product-delivery-date-for-woocommerce-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Delivery Date for WooCommerce – Lite: from n/a through <= 3.2.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Tychesoftwares Wordpress
Products
Product Delivery Date For Woocommerce Lite Wordpress
CVE-2025-63024

WordPress Order Delivery Date for WooCommerce plugin <= 4.3.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in tychesoftwares Order Delivery Date for WooCommerce order-delivery-date-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Delivery Date for WooCommerce: from n/a through <= 4.3.1.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Tychesoftwares Wordpress
Products
Order Delivery Date For Woocommerce Wordpress
CVE-2025-66085

WordPress Arconix Shortcodes plugin <= 2.1.18 - Broken Access Control vulnerability

Missing Authorization vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Arconix Shortcodes: from n/a through <= 2.1.18.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Tychesoftwares Wordpress
Products
Arconix Shortcodes Wordpress
CVE-2025-58599

WordPress Order Delivery Date for WooCommerce Plugin <= 4.1.0 - Broken Access Control Vulnerability

Missing Authorization vulnerability in tychesoftwares Order Delivery Date for WooCommerce order-delivery-date-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Delivery Date for WooCommerce: from n/a through <= 4.1.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Tychesoftwares Wordpress
Products
Order Delivery Date For Woocommerce Wordpress
CVE-2025-49874

WordPress Arconix FAQ plugin <= 1.9.6 - Broken Access Control Vulnerability

Missing Authorization vulnerability in tychesoftwares Arconix FAQ arconix-faq allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Arconix FAQ: from n/a through <= 1.9.6.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Tychesoftwares
Products
Arconix Faq
CVE-2025-47673

WordPress Arconix Shortcodes plugin <= 2.1.16 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allows Reflected XSS.This issue affects Arconix Shortcodes: from n/a through <= 2.1.16.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Tychesoftwares
Products
Arconix Shortcodes
CVE-2025-32531

WordPress Arconix FAQ plugin <= 1.9.5 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tychesoftwares Arconix FAQ arconix-faq allows Reflected XSS.This issue affects Arconix FAQ: from n/a through <= 1.9.5.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Tychesoftwares Wordpress
Products
Arconix Faq Wordpress