Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-08-26
WooCommerce Subscriptions - Remote Code Execution (CVE-2026-18391)
The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain present in the bundled dependencies.
PLUGIN
WooCommerce Subscriptions
CVE-2026-18391
Risk Score
Threat Entry
Updated 2026-06-17
Woocommerce Subscriptions - Broken Access Control (CVE-2023-50850)
Missing Authorization vulnerability in Woo WooCommerce Subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Subscriptions: from n/a before 5.8.0.
PLUGIN
Woocommerce Subscriptions
CVE-2023-50850
Risk Score
Threat Entry
Updated 2026-06-17
Woocommerce Subscriptions - Broken Access Control (CVE-2023-35914)
Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce Woo Subscriptions.This issue affects Woo Subscriptions: from n/a through 5.1.2.
PLUGIN
Woocommerce Subscriptions
CVE-2023-35914
Risk Score
Threat Entry
Updated 2026-06-17
WooCommerce Subscriptions - Cross-Site Scripting (XSS) (CVE-2019-18834)
Persistent XSS in the WooCommerce Subscriptions plugin before 2.6.3 for WordPress allows remote attackers to execute arbitrary JavaScript because Billing Details are mishandled in WCS_Admin_Post_Types in class-wcs-admin-post-types.php.
PLUGIN
WooCommerce Subscriptions
CVE-2019-18834
Risk Score