Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-07
Woocommerce Multilingual - Security Vulnerability (CVE-2026-120563)
The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 5.5.7. This is due to insufficient input validation on the currency exchange rate parameter in the save_currency() AJAX handler, which lacks capability checks and allows subscriber-level users to store malicious SQL payloads that are later concatenated directly into ORDER BY clauses without proper sanitization. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to append additional SQL queries to extract sensitive information from the…
PLUGIN
Woocommerce Multilingual
CVE-2026-120563
Risk Score
Threat Entry
Updated 2026-10-11
Woocommerce Multilingual - Security Vulnerability (CVE-2026-62130)
Shop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency
PLUGIN
Woocommerce Multilingual
CVE-2026-62130
Risk Score
Threat Entry
Updated 2026-08-12
Woocommerce Multilingual - Cross-Site Scripting (XSS) (CVE-2026-66711)
Subscriber Cross Site Scripting (XSS) in WooCommerce Multilingual & Multicurrency
PLUGIN
Woocommerce Multilingual
CVE-2026-66711
Risk Score
Threat Entry
Updated 2026-06-17
Woocommerce Multilingual - Broken Access Control (CVE-2025-26888)
Missing Authorization vulnerability in Amir Helzer WooCommerce Multilingual & Multicurrency woocommerce-multilingual allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Multilingual & Multicurrency: from n/a through
PLUGIN
Woocommerce Multilingual
CVE-2025-26888
Risk Score
Threat Entry
Updated 2026-06-17
Woocommerce Multilingual - Cross-Site Scripting (XSS) (CVE-2024-8629)
The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 5.3.7. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Woocommerce Multilingual
CVE-2024-8629
Risk Score