sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total47
Critical1
High9
Medium37
Reset
Showing 1-20 of 47 records
Threat Entry Updated 2026-09-04

Woocommerce - SQL Injection (CVE-2026-57777)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Automattic WooCommerce allows Blind SQL Injection. This issue affects WooCommerce: from n/a before 11.0.

PLUGIN Woocommerce

CVE-2026-57777

HIGH CVSS 7.6 2026-09-04
Open Full Technical Breakdown
Threat Entry Updated 2026-06-22

Woocommerce - Remote Code Execution (CVE-2022-50972)

WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by injecting shell commands through the product-type parameter. Attackers can send requests to the class-wc-meta-box-product-images.php endpoint with unsanitized product-type values to write malicious PHP files to the web root.

PLUGIN Woocommerce

CVE-2022-50972

CRITICAL CVSS 9.3 2026-06-20
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WooCommerce - Cross-Site Request Forgery (CSRF) (CVE-2026-3589)

The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allow unauthenticated users to make a logged in admin call non store/WC REST endpoints, and create arbitrary admin users via a CSRF attack for example.

PLUGIN WooCommerce

CVE-2026-3589

HIGH CVSS 7.5 2026-03-06
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WooCommerce - Remote Code Execution (CVE-2026-28132)

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in villatheme WooCommerce Photo Reviews woocommerce-photo-reviews allows Code Injection.This issue affects WooCommerce Photo Reviews: from n/a through

PLUGIN WooCommerce

CVE-2026-28132

MEDIUM CVSS 5.3 2026-02-26
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WooCommerce - Information Disclosure (CVE-2026-24992)

Insertion of Sensitive Information Into Sent Data vulnerability in WPFactory Advanced WooCommerce Product Sales Reporting webd-woocommerce-advanced-reporting-statistics allows Retrieve Embedded Sensitive Data.This issue affects Advanced WooCommerce Product Sales Reporting: from n/a through

PLUGIN WooCommerce

CVE-2026-24992

MEDIUM CVSS 5.3 2026-02-03
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WooCommerce - Broken Access Control (CVE-2026-24625)

Missing Authorization vulnerability in Imaginate Solutions File Uploads Addon for WooCommerce woo-addon-uploads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects File Uploads Addon for WooCommerce: from n/a through

PLUGIN WooCommerce

CVE-2026-24625

MEDIUM CVSS 5.3 2026-01-23
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WooCommerce - Broken Access Control (CVE-2026-24585)

Missing Authorization vulnerability in Hyyan Abo Fakher Hyyan WooCommerce Polylang Integration woo-poly-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hyyan WooCommerce Polylang Integration: from n/a through

PLUGIN WooCommerce

CVE-2026-24585

MEDIUM CVSS 6.5 2026-01-23
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WooCommerce - Broken Access Control (CVE-2026-24581)

Missing Authorization vulnerability in WP Swings Points and Rewards for WooCommerce points-and-rewards-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Points and Rewards for WooCommerce: from n/a through

PLUGIN WooCommerce

CVE-2026-24581

MEDIUM CVSS 5.4 2026-01-23
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WooCommerce - Broken Access Control (CVE-2026-24583)

Missing Authorization vulnerability in sumup SumUp Payment Gateway For WooCommerce sumup-payment-gateway-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SumUp Payment Gateway For WooCommerce: from n/a through

PLUGIN WooCommerce

CVE-2026-24583

MEDIUM CVSS 5.3 2026-01-23
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WooCommerce - Broken Access Control (CVE-2026-24562)

Missing Authorization vulnerability in Ryviu Ryviu – Product Reviews for WooCommerce ryviu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ryviu – Product Reviews for WooCommerce: from n/a through

PLUGIN WooCommerce

CVE-2026-24562

MEDIUM CVSS 5.3 2026-01-23
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WooCommerce - Information Disclosure (CVE-2026-24553)

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Dotstore Fraud Prevention For Woocommerce woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers allows Retrieve Embedded Sensitive Data.This issue affects Fraud Prevention For Woocommerce: from n/a through

PLUGIN WooCommerce

CVE-2026-24553

MEDIUM CVSS 4.3 2026-01-23
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WooCommerce - Cross-Site Scripting (XSS) (CVE-2026-24526)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Steve Truman Email Inquiry & Cart Options for WooCommerce woocommerce-email-inquiry-cart-options allows DOM-Based XSS.This issue affects Email Inquiry & Cart Options for WooCommerce: from n/a through

PLUGIN WooCommerce

CVE-2026-24526

MEDIUM CVSS 6.5 2026-01-23
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WooCommerce - Broken Access Control (CVE-2026-24366)

Missing Authorization vulnerability in YITHEMES YITH WooCommerce Request A Quote yith-woocommerce-request-a-quote allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Request A Quote: from n/a through

PLUGIN WooCommerce

CVE-2026-24366

MEDIUM CVSS 5.3 2026-01-22
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.