Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-08-20
Woocommerce Pos - Remote Code Execution (CVE-2026-17581)
The WCPOS – Point of Sale (POS) plugin for WooCommerce plugin for WordPress is vulnerable to Code Injection via the 'thermal' Template Engine in all versions up to, and including, 1.9.14 due to the Receipt_Renderer_Factory dispatching templates with the 'thermal' engine to the Legacy_Php_Renderer instead of a safe thermal-specific renderer. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject arbitrary PHP code into a template post that is subsequently written to a temporary file and executed via PHP's include(), resulting in remote code execution…
PLUGIN
Woocommerce Pos
CVE-2026-17581
Risk Score
Threat Entry
Updated 2026-07-23
Woocommerce Pos - Path Traversal (CVE-2026-16078)
The WCPOS – Point of Sale (POS) plugin for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.9.8 via the 'type' parameter parameter. This makes it possible for authenticated attackers, with shop manager-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Successful exploitation requires supplying context=edit in the request, which bypasses the content-stripping logic in prepare_item_for_response() and returns the traversed file verbatim in the REST API response.
PLUGIN
Woocommerce Pos
CVE-2026-16078
Risk Score
Threat Entry
Updated 2026-06-17
WooCommerce POS - Broken Access Control (CVE-2026-52711)
Unauthenticated Broken Access Control in WooCommerce POS
PLUGIN
WooCommerce POS
CVE-2026-52711
Risk Score
Threat Entry
Updated 2026-06-17
Woocommerce Pos - Broken Access Control (CVE-2025-48117)
Missing Authorization vulnerability in kilbot WooCommerce POS woocommerce-pos allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce POS: from n/a through
PLUGIN
Woocommerce Pos
CVE-2025-48117
Risk Score
Threat Entry
Updated 2026-06-17
Woocommerce Pos - Information Disclosure (CVE-2024-2384)
The WooCommerce POS plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 1.4.11. This is due to the plugin not properly verifying the authentication and authorization of the current user This makes it possible for authenticated attackers, with customer-level access and above, to view potentially sensitive information about other users by leveraging their order id
PLUGIN
Woocommerce Pos
CVE-2024-2384
Risk Score