Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-08
Printcart Integration - Security Vulnerability (CVE-2026-19803)
The Printcart Store – Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.13.2. This is due to the `nbu_crop_image` AJAX handler accepting a user-supplied `url` parameter that `Nbdesigner_IO::convert_url_to_path()` concatenates onto the uploads base directory without normalizing or stripping `../` sequences, and then deriving both the output directory and output file extension via `pathinfo()` from the same attacker-controlled path — with no `stripImage()` call before `writeImage()` is invoked. This makes it possible for unauthenticated attackers to…
PLUGIN
Printcart Integration
CVE-2026-19803
Risk Score
Threat Entry
Updated 2026-09-18
Printcart Integration - Security Vulnerability (CVE-2026-14323)
The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.8.5 via the 'mockups' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. A valid nonce is obtainable by unauthenticated users via the companion nbd_check_use_logged_in nopriv AJAX endpoint, which freely mints and returns a nbdesigner-get-data nonce to any visitor; additionally, if the NBDESIGNER_ENABLE_NONCE constant is disabled, even this nonce gate is bypassed…
PLUGIN
Printcart Integration
CVE-2026-14323
Risk Score
Threat Entry
Updated 2026-07-07
Printcart Integration - Remote Code Execution (CVE-2026-9725)
The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 2.5.2 This is due to insufficient path validation in the store_design_data() function, which constructs a filesystem path from the user-supplied 'nbd_item_key' POST parameter sanitized only with sanitize_text_field() — which does not strip path traversal sequences — and then passes that path directly to Nbdesigner_IO::delete_folder() and PHP's rename(). The nonce protecting the nbd_save_customer_design AJAX action is freely obtainable by unauthenticated users via the nbd_check_use_logged_in endpoint. This makes…
PLUGIN
Printcart Integration
CVE-2026-9725
Risk Score
Threat Entry
Updated 2026-06-17
Printcart Integration - Broken Access Control (CVE-2025-57917)
Missing Authorization vulnerability in printcart Printcart Web to Print Product Designer for WooCommerce printcart-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Printcart Web to Print Product Designer for WooCommerce: from n/a through
PLUGIN
Printcart Integration
CVE-2025-57917
Risk Score
Threat Entry
Updated 2026-06-17
Printcart Integration - SQL Injection (CVE-2025-24780)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in printcart Printcart Web to Print Product Designer for WooCommerce printcart-integration allows SQL Injection.This issue affects Printcart Web to Print Product Designer for WooCommerce: from n/a through
PLUGIN
Printcart Integration
CVE-2025-24780
Risk Score
Threat Entry
Updated 2026-06-17
Printcart Integration - Arbitrary File Upload (CVE-2025-47641)
Unrestricted Upload of File with Dangerous Type vulnerability in printcart Printcart Web to Print Product Designer for WooCommerce printcart-integration allows Upload a Web Shell to a Web Server.This issue affects Printcart Web to Print Product Designer for WooCommerce: from n/a through
PLUGIN
Printcart Integration
CVE-2025-47641
Risk Score
Threat Entry
Updated 2026-06-17
Printcart Integration - SQL Injection (CVE-2025-47640)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in printcart Printcart Web to Print Product Designer for WooCommerce printcart-integration allows SQL Injection.This issue affects Printcart Web to Print Product Designer for WooCommerce: from n/a through
PLUGIN
Printcart Integration
CVE-2025-47640
Risk Score