Threat Entry Updated 2026-07-13

CVE-2026-57424 - Razorpay Payment Links for WooCommerce Plugin

Missing Authorization vulnerability in knitpay Razorpay Payment Links for WooCommerce rzp-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Razorpay Payment Links for WooCommerce: from n/a through

PLUGIN Razorpay Payment Links for WooCommerce

CVE-2026-57424

MEDIUM CVSS 6.5 2026-07-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-13

CVE-2026-57691 - Anti-Malware Security and Brute-Force Firewall Plugin

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eli Anti-Malware Security and Brute-Force Firewall gotmls allows Reflected XSS.This issue affects Anti-Malware Security and Brute-Force Firewall: from n/a through

PLUGIN Anti-Malware Security and Brute-Force Firewall

CVE-2026-57691

MEDIUM CVSS 5.8 2026-07-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-13

CVE-2026-57420 - Author Box WP Lens Plugin

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Netrr Author Box WP Lens author-box-for-divi allows Stored XSS.This issue affects Author Box WP Lens: from n/a through

PLUGIN Author Box WP Lens

CVE-2026-57420

MEDIUM CVSS 6.5 2026-07-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-13

CVE-2026-57419 - Stock Locations for WooCommerce Plugin

Missing Authorization vulnerability in Fahad Mahmood Stock Locations for WooCommerce stock-locations-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stock Locations for WooCommerce: from n/a through

PLUGIN Stock Locations for WooCommerce

CVE-2026-57419

MEDIUM CVSS 6.5 2026-07-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-13

CVE-2026-57418 - Client Invoicing by Sprout Invoices Plugin

Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through

PLUGIN Client Invoicing by Sprout Invoices

CVE-2026-57418

MEDIUM CVSS 6.5 2026-07-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-13

CVE-2026-57414 - ChatBot for eCommerce – WoowBot Plugin

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud ChatBot for eCommerce – WoowBot woowbot-woocommerce-chatbot allows Stored XSS.This issue affects ChatBot for eCommerce – WoowBot: from n/a through

PLUGIN ChatBot for eCommerce – WoowBot

CVE-2026-57414

MEDIUM CVSS 6.5 2026-07-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-13

CVE-2026-57413 - Instant Image Generator Plugin

Server-Side Request Forgery (SSRF) vulnerability in bdthemes Instant Image Generator ai-image allows Server Side Request Forgery.This issue affects Instant Image Generator: from n/a through

PLUGIN Instant Image Generator

CVE-2026-57413

MEDIUM CVSS 6.4 2026-07-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-13

CVE-2026-57412 - Gift Vouchers Plugin

Missing Authorization vulnerability in Codemenschen Gift Vouchers gift-voucher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gift Vouchers: from n/a through

PLUGIN Gift Vouchers

CVE-2026-57412

MEDIUM CVSS 6.5 2026-07-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-13

CVE-2026-57408 - Peach Payments Gateway Plugin

Missing Authorization vulnerability in peachpayments Peach Payments Gateway wc-peach-payments-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Peach Payments Gateway: from n/a through

PLUGIN Peach Payments Gateway

CVE-2026-57408

MEDIUM CVSS 6.5 2026-07-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-13

CVE-2026-57406 - FundEngine Plugin

Missing Authorization vulnerability in Roxnor FundEngine wp-fundraising-donation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FundEngine: from n/a through

PLUGIN FundEngine

CVE-2026-57406

MEDIUM CVSS 6.5 2026-07-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-13

CVE-2026-57404 - Booking and Rental Manager Plugin

Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking and Rental Manager: from n/a through

PLUGIN Booking and Rental Manager

CVE-2026-57404

MEDIUM CVSS 6.5 2026-07-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-13

CVE-2026-57402 - Flexible Refund and Return Order for WooCommerce Plugin

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdesk Flexible Refund and Return Order for WooCommerce flexible-refund-and-return-order-for-woocommerce allows Stored XSS.This issue affects Flexible Refund and Return Order for WooCommerce: from n/a through

PLUGIN Flexible Refund and Return Order for WooCommerce

CVE-2026-57402

MEDIUM CVSS 6.5 2026-07-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-13

CVE-2026-57400 - Event Tickets Manager for WooCommerce Plugin

Missing Authorization vulnerability in WP Swings Event Tickets Manager for WooCommerce event-tickets-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets Manager for WooCommerce: from n/a through

PLUGIN Event Tickets Manager for WooCommerce

CVE-2026-57400

MEDIUM CVSS 6.5 2026-07-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-13

CVE-2026-57395 - Tourfic Plugin

Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tourfic: from n/a through

PLUGIN Tourfic

CVE-2026-57395

MEDIUM CVSS 6.5 2026-07-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-13

CVE-2026-57393 - WooCommerce PDF Invoice Builder Plugin

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in EDGARROJAS WooCommerce PDF Invoice Builder woo-pdf-invoice-builder allows Retrieve Embedded Sensitive Data.This issue affects WooCommerce PDF Invoice Builder: from n/a through

PLUGIN WooCommerce PDF Invoice Builder

CVE-2026-57393

MEDIUM CVSS 6.5 2026-07-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-13

CVE-2026-57392 - Tourfic Plugin

Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tourfic: from n/a through

PLUGIN Tourfic

CVE-2026-57392

MEDIUM CVSS 6.5 2026-07-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-13

CVE-2026-57391 - Loops & Logic Plugin

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tangible Loops & Logic tangible-loops-and-logic allows Stored XSS.This issue affects Loops & Logic: from n/a through

PLUGIN Loops & Logic

CVE-2026-57391

MEDIUM CVSS 6.5 2026-07-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-13

CVE-2026-57390 - Extra Product Options Builder for WooCommerce Plugin

Missing Authorization vulnerability in EDGARROJAS Extra Product Options Builder for WooCommerce additional-product-fields-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Extra Product Options Builder for WooCommerce: from n/a through

PLUGIN Extra Product Options Builder for WooCommerce

CVE-2026-57390

MEDIUM CVSS 6.5 2026-07-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-13

CVE-2026-57377 - WowAddons Plugin

Missing Authorization vulnerability in WPXPO WowAddons product-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WowAddons: from n/a through

PLUGIN WowAddons

CVE-2026-57377

MEDIUM CVSS 6.5 2026-07-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-13

CVE-2026-57375 - MStore API Plugin

Missing Authorization vulnerability in FluxBuilder MStore API mstore-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MStore API: from n/a through

PLUGIN MStore API

CVE-2026-57375

MEDIUM CVSS 6.5 2026-07-13

Risk Score

Open Full Technical Breakdown