Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-06
Order Tracking - Security Vulnerability (CVE-2026-121633)
The Order Tracking WordPress plugin before 3.6.0 does not verify that a PayPal payment notification was sent to the merchant's account, or that its amount matches the order total, before marking an order as paid, which could allow unauthenticated attackers to mark arbitrary orders as paid using a trivial payment to their own PayPal account.
PLUGIN
Order Tracking
CVE-2026-121633
Risk Score
Threat Entry
Updated 2026-07-24
Order Tracking - Broken Access Control (CVE-2026-39602)
Missing Authorization vulnerability in Rustaurius Order Tracking order-tracking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Tracking: from n/a through
PLUGIN
Order Tracking
CVE-2026-39602
Risk Score
Threat Entry
Updated 2026-06-17
Order Tracking - Broken Access Control (CVE-2024-43343)
Missing Authorization vulnerability in Etoile Web Design Order Tracking allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Order Tracking: from n/a through 3.3.12.
PLUGIN
Order Tracking
CVE-2024-43343
Risk Score
Threat Entry
Updated 2026-06-17
Order Tracking - Cross-Site Scripting (XSS) (CVE-2023-4471)
The Order Tracking Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the start_date and end_date parameters in versions up to, and including, 3.3.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Order Tracking
CVE-2023-4471
Risk Score
Threat Entry
Updated 2026-06-17
Order Tracking - Cross-Site Scripting (XSS) (CVE-2023-4500)
The Order Tracking Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the order status parameter in versions up to, and including, 3.3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers (admin or higher) to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This only affects multi-site installations and installations where unfiltered_html has been disabled.
PLUGIN
Order Tracking
CVE-2023-4500
Risk Score