Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-08-20
WCPOS - Remote Code Execution (CVE-2026-17581)
The WCPOS – Point of Sale (POS) plugin for WooCommerce plugin for WordPress is vulnerable to Code Injection via the 'thermal' Template Engine in all versions up to, and including, 1.9.14 due to the Receipt_Renderer_Factory dispatching templates with the 'thermal' engine to the Legacy_Php_Renderer instead of a safe thermal-specific renderer. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject arbitrary PHP code into a template post that is subsequently written to a temporary file and executed via PHP's include(), resulting in remote code execution…
PLUGIN
WCPOS
CVE-2026-17581
Risk Score
Threat Entry
Updated 2026-07-23
WCPOS - Path Traversal (CVE-2026-16078)
The WCPOS – Point of Sale (POS) plugin for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.9.8 via the 'type' parameter parameter. This makes it possible for authenticated attackers, with shop manager-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Successful exploitation requires supplying context=edit in the request, which bypasses the content-stripping logic in prepare_item_for_response() and returns the traversed file verbatim in the REST API response.
PLUGIN
WCPOS
CVE-2026-16078
Risk Score