Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-100142

FluentCart < 2.2.0 - Unauthenticated Customer Address Disclosure via IDOR

The FluentCart A New Era of eCommerce WordPress plugin before 2.2.0 does not verify that a stored customer address selected during checkout belongs to the requester, allowing unauthenticated attackers to attach any customer's stored address to an order they place and read it back, disclosing customers' postal addresses, phone numbers and company details.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Fluentcart Wordpress-extensions
Products
A New Era Of Ecommerce Fluentcart
CVE-2026-14926

FluentCart < 1.4.0 - Subscriber+ Subscription Payment-Method Tampering via IDOR

The FluentCart A New Era of eCommerce WordPress plugin before 1.4.0 does not verify that a subscription belongs to the requesting customer in several of its payment-method endpoints, allowing any authenticated customer to act on another customer's subscription (changing its payment method, or cancelling and re-binding it) when they know the target subscription identifier.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Fluentcart Wordpress
Products
A New Era Of Ecommerce Wordpress