Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-09
Shopengine - Security Vulnerability (CVE-2026-122673)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet ShopEngine shopengine allows Stored XSS.This issue affects ShopEngine: from n/a through 4.9.8.
PLUGIN
Shopengine
CVE-2026-122673
Risk Score
Threat Entry
Updated 2026-09-28
Shopengine - Privilege Escalation (CVE-2026-75971)
The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9.4. This is due to the `rum_importer()` function being registered on the WordPress core `import_start` action hook with no plugin-owned capability check and no allowlist filtering, causing arbitrary `` name/value pairs parsed from an attacker-supplied WXR import file to be passed directly to `update_option()`. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to write arbitrary WordPress options —…
PLUGIN
Shopengine
CVE-2026-75971
Risk Score
Threat Entry
Updated 2026-06-17
Shopengine - Cross-Site Request Forgery (CSRF) (CVE-2025-12358)
The ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.8.5. This is due to missing nonce validation on the "post_add_to_list" function as well as an incorrect permissions callback in the "Api/init" function. This makes it possible for unauthenticated attackers to add or remove products from a user's wishlist via a forged request granted they can trick a site's user into performing an action such as clicking on a link.
PLUGIN
Shopengine
CVE-2025-12358
Risk Score
Threat Entry
Updated 2026-06-17
Shopengine - Security Vulnerability (CVE-2025-11888)
The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient capability check on the post_deactive() function and post_activate() function in all versions up to, and including, 4.8.4. This makes it possible for authenticated attackers, with Editor-level access and above, to activate and deactivate licenses.
PLUGIN
Shopengine
CVE-2025-11888
Risk Score
Threat Entry
Updated 2026-06-17
Shopengine - Cross-Site Request Forgery (CSRF) (CVE-2022-45371)
Cross-Site Request Forgery (CSRF) vulnerability in Wpmet ShopEngine plugin
PLUGIN
Shopengine
CVE-2022-45371
Risk Score