Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-21
RestroPress - Security Vulnerability (CVE-2026-85010)
The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplied item add-on price on the server side when items are added to or updated in the cart, allowing unauthenticated users to set an arbitrary price and place orders for an attacker-chosen total, down to and including zero.
PLUGIN
RestroPress
CVE-2026-85010
Risk Score
Threat Entry
Updated 2026-09-18
RestroPress - Security Vulnerability (CVE-2026-85009)
The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied order identifier, allowing unauthenticated attackers to enumerate which orders are in a recoverable state and to write notes to another customer's order.
PLUGIN
RestroPress
CVE-2026-85009
Risk Score
Threat Entry
Updated 2026-06-17
Restropress - Broken Access Control (CVE-2025-62129)
Missing Authorization vulnerability in Magnigenie RestroPress restropress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RestroPress: from n/a through
PLUGIN
Restropress
CVE-2025-62129
Risk Score
Threat Entry
Updated 2026-06-17
Restropress - Cross-Site Scripting (XSS) (CVE-2025-69017)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magnigenie RestroPress restropress allows Stored XSS.This issue affects RestroPress: from n/a through
PLUGIN
Restropress
CVE-2025-69017
Risk Score
Threat Entry
Updated 2026-06-17
Restropress - Broken Access Control (CVE-2025-66100)
Missing Authorization vulnerability in Magnigenie RestroPress restropress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RestroPress: from n/a through
PLUGIN
Restropress
CVE-2025-66100
Risk Score
Threat Entry
Updated 2026-06-17
Restropress - Authentication Bypass (CVE-2025-9209)
The RestroPress – Online Food Ordering System plugin for WordPress is vulnerable to Authentication Bypass in versions 3.0.0 to 3.1.9.2. This is due to the plugin exposing user private tokens and API data via the /wp-json/wp/v2/users REST API endpoint. This makes it possible for unauthenticated attackers to forge JWT tokens for other users, including administrators, and authenticate as them.
PLUGIN
Restropress
CVE-2025-9209
Risk Score
Threat Entry
Updated 2026-06-17
Restropress - Cross-Site Scripting (XSS) (CVE-2025-32553)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magnigenie RestroPress restropress allows Reflected XSS.This issue affects RestroPress: from n/a through
PLUGIN
Restropress
CVE-2025-32553
Risk Score
Threat Entry
Updated 2026-06-17
Restropress - Broken Access Control (CVE-2025-31877)
Missing Authorization vulnerability in Magnigenie RestroPress restropress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RestroPress: from n/a through
PLUGIN
Restropress
CVE-2025-31877
Risk Score
Threat Entry
Updated 2026-06-17
Restropress - Cross-Site Scripting (XSS) (CVE-2024-35719)
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in MagniGenie RestroPress allows Stored XSS.This issue affects RestroPress: from n/a through 3.1.2.1.
PLUGIN
Restropress
CVE-2024-35719
Risk Score