21
CVEs
1
Critical
7
High
0
KEV
0
PoC
8
Unpatched C/H
0.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
7
MEDIUM
12
LOW
1
Monthly CVE Trend
Affected Products (30)
Wordpress Plugin
39
Woocommerce
11
Photo Reviews For Woocommerce
5
Curcy
3
Abandoned Cart Recovery For Woocommerce
3
Ald Dropshipping And Fulfillment For Aliexpress And Woocommerce
2
Buildkit Product Builder For Woocommerce Custom Pc Builder
2
Thank You Page Customizer For Woocommerce
2
Gift4U
2
Bopo Woocommerce Product Bundle Builder
2
Wpbulky
2
Woocommerce Thank You Page Customizer
2
Affi Affiliate Marketing For Woocommerce
2
Tmds
1
PHP
1
Suggestion Engine For Woocommerce
1
S2W Import Shopify To Woocommerce
1
W2S
1
Orders Tracking For Woocommerce
1
Customer Coupons For Woocommerce
1
Dropshipping And Fulfillment For Aliexpress And Woocommerce
1
Product Variations Swatches For Woocommerce
1
Product Size Chart For Woocommerce
1
Curcy Multi Currency For Woocommerce Smoothly On Woocommerce 9 X
1
Woocommerce Email Template Customizer
1
Happy
1
Salevo
1
Lookzy
1
Woocommerce Multi Currency
1
Exmage
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-104398 | Unauthenticated PHP Object Injection in the AFFI - Affiliate Marketing for WooCommerce WordPress plugin (all versions through 1.0.10) allows remote attackers to pass crafted serialized data to PHP unserialize(), enabling arbitrary object instantiation that could lead to remote code execution, file manipulation, or data theft if a viable POP gadget chain exists in the plugin, WordPress core, WooCommerce, or other installed extensions. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required to reach the vulnerable code path, but the independent assessment notes that real-world severity depends heavily on the presence of a usable gadget chain, making the nominal 9.8 score more nuanced in practice. No public exploit identified at time of analysis, and no CISA KEV listing was provided in the intelligence; the sole reference is the Patchstack vulnerability database entry. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2026-102379 | Blind SQL injection in the VillaTheme BuildKit - Product Builder for WooCommerce - Custom PC Builder WordPress plugin (all versions through 1.0.28) lets an authenticated, low-privilege user on a WooCommerce site inject SQL into plugin-supplied queries and infer database contents one bit at a time. Because the injection is blind, extraction is slow but still permits disclosure of high-impact data such as WordPress user hashes, customer records, and WooCommerce order details. The flaw rates CVSS 3.1 8.5 (HIGH) with remote reachability, low attack complexity, and no user interaction, and the primary barrier is the requirement for a valid low-privileged account (PR:L). No public exploit code and no confirmed active exploitation were identified at time of analysis. | HIGH | 8.5 | 0.2% | 42 |
No patch
|
| CVE-2026-101923 | Unauthenticated attackers can permanently delete arbitrary posts, pages, products, and media attachments on any WordPress site running the Photo Reviews for WooCommerce plugin through version 1.2.30. The plugin accepts attacker-controlled post IDs in the public wcpr_image_upload_id parameter of a review submission and stores them as the review's 'reviews-images' comment meta without verifying that those IDs belong to attachments owned by the submitter; when the review is later deleted, the delete_reviews_image() handler unconditionally calls wp_delete_post( $id, true ) on every stored ID. Because the trigger is a privileged action - an administrator deleting the planted review, or WordPress's built-in wp_scheduled_delete cron emptying the comment trash roughly 30 days after the review is trashed - this is a credible high-integrity, high-availability issue rather than an instantly weaponizable one, and no public exploit code or CISA KEV entry was identified at time of analysis. | HIGH | 8.1 | 0.3% | 41 |
No patch
|
| CVE-2026-103071 | Unauthenticated code injection in the VillaTheme 'Thank You Page Customizer for WooCommerce' plugin, versions up to and including 1.2.3, lets a remote attacker who can reach a site running the plugin cause arbitrary code to be generated and executed, primarily threatening the integrity of the WordPress installation (CVSS 3.1 base 7.5, vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N per independent assessment). Any store that has both WooCommerce and this specific plugin installed and active is exposed, requires no credentials or user interaction, and is exploitable against default configurations. At time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified, and no vendor-released fixed version was found in the available data, so the practical risk is bounded by the narrow deployment scope of this relatively uncommon plugin rather than by any mass-exploitation signal. | HIGH | 7.5 | 0.2% | 38 |
No patch
|
| CVE-2026-100517 | Unauthenticated Insecure Direct Object Reference (IDOR) in the Photo Reviews for WooCommerce WordPress plugin, affecting all versions up to and including 1.2.30, allows remote attackers with no credentials and no user interaction to reference objects they should not be authorized to reach, degrading availability of the affected site's review functionality (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Exploitation requires only that the plugin be installed and active on a network-reachable WordPress/WooCommerce installation; no special feature toggle or non-default configuration is named in the advisory. There is no public exploit code identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), so exposure is currently driven by the low attack complexity and the unauthenticated, remote nature of the flaw rather than by observed in-the-wild activity. | HIGH | 7.5 | 0.3% | 38 |
No patch
|
| CVE-2026-100161 | Stored DOM-based cross-site scripting in the VillaTheme Photo Reviews for WooCommerce plugin through version 1.2.30 lets unauthenticated visitors inject arbitrary web scripts into review-related comment meta, which execute when a shopper or admin later loads a product page displaying the affected review. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, and the only gate is the publicly emitted `wcpr_image_upload` nonce, so no authentication, capability, or attachment-ownership check is required. No public exploit identified at time of analysis, and there is no CISA KEV confirmation of active exploitation. | HIGH | 7.2 | 0.3% | 36 |
No patch
|
| CVE-2026-94171 | Unauthenticated cross-site scripting in the CURCY (Woo Multi Currency) plugin for WordPress, affecting all versions up to and including 2.2.16, allows remote attackers to inject and execute arbitrary script in the context of a victim's browsing session. Exploitation is network-reachable and low-complexity and requires no authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 7.1), but it does require victim user interaction - the target must click a crafted link or otherwise render attacker-controlled content - and it only affects WordPress sites where the vulnerable plugin is installed and active. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied; the practical exposure is therefore driven by user interaction and by how many sites still run CURCY at or below 2.2.16. | HIGH | 7.1 | 0.3% | 36 |
No patch
|
| CVE-2026-100515 | Reflected cross-site scripting (XSS) in the VillaTheme 'Photo Reviews for WooCommerce' plugin for WordPress affects all versions through 1.2.30, allowing an unauthenticated attacker to inject script into a page viewed by a victim. Exploitation is phishing-driven: the attacker must lure a targeted visitor to a crafted URL, and the payload executes only in that victim's browser session, giving CVSS 3.1 a base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) rather than server-wide compromise. No public exploit code identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); the vulnerability was reported by Patchstack and the exact vulnerable parameter or endpoint is not detailed in the available data. | HIGH | 7.1 | 0.2% | 36 |
No patch
|
| CVE-2026-103357 | Missing authorization in VillaTheme GIFT4U (gift4u-gift-cards-all-in-one-for-woo) versions 1.1.3 and earlier allows unauthenticated remote attackers to tamper with limited gift-card-related data on WordPress/WooCommerce sites where the plugin is active. The flaw (CWE-862) stems from the plugin failing to enforce an access-control check on a restricted function, and per the CVSS vector (PR:N/UI:N) no authentication or user interaction is required. No public exploit code or active exploitation has been identified at time of analysis, and the impact is limited to integrity (VI:L) with no confidentiality or availability impact, resulting in a medium-severity rating. | MEDIUM | 6.9 | 0.3% | 35 |
No patch
|
| CVE-2026-102383 | Missing authorization checks (CWE-862) in the VillaTheme Lookzy / woo-lookbook WordPress plugin, versions up to and including 1.1.14, let remote unauthenticated attackers invoke plugin functionality that should be protected by access-control and capability checks. Affected sites are those running the plugin (typically alongside WooCommerce) on internet-reachable WordPress installations; per the assessed vector AV:N/AC:L/PR:N/UI:N, exploitation is remote, unauthenticated, and requires no user interaction. Impact is bounded to the plugin's own functionality (integrity and availability low, confidentiality none), and no public exploit code has been identified at time of analysis, so the practical risk is constrained by the narrow population of sites running this specific plugin. | MEDIUM | 6.5 | 0.3% | 33 |
No patch
|
| CVE-2026-103356 | Authenticated users with only low privileges (for example a WordPress subscriber or registered WooCommerce customer) can reach at least one TMDS dropshipping plugin action that performs no authorization check, allowing them to make unauthorized state changes against a WordPress site running TMDS 1.0.15 or earlier. The vendor-assigned CVSS of 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) reflects limited integrity and availability impact with no confidentiality loss, and exploitation requires a valid low-privilege account, so the practical risk is moderate rather than critical. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and no EPSS or CISA KEV data was supplied; only a Patchstack advisory (credited as the reporting source) documents the issue. | MEDIUM | 5.4 | 0.2% | 27 |
No patch
|
| CVE-2026-97275 | Unauthenticated remote attackers can manipulate the quantity input handled by VillaTheme's BuildKit - Product Builder for WooCommerce - Custom PC Builder (all versions through 1.0.28), altering builder-supplied configuration data on affected stores. The defect is an improper-validation-of-specified-quantity flaw (CWE-1284): the plugin accepts a caller-supplied quantity without adequately checking its type, bounds, or consistency, so a crafted request can subvert the value the builder relies on. Impact is confined to integrity per the assessed vector (CVSS 5.3, I:L with C:N/A:N), and no public exploit code or confirmed active exploitation was identified at time of analysis; the narrow deployment base of this niche PC-builder plugin further limits real-world exposure. | MEDIUM | 5.3 | 0.2% | 27 |
No patch
|
| CVE-2026-97071 | Incorrect currency-calculation logic in the VillaTheme CURCY (woo-multi-currency) WordPress plugin, present in every release up to and including 2.2.17, allows remote attackers to trigger a bounded security impact against an affected site - the supplied vector requires no authentication, no user interaction, and no special configuration (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). At CVSS 5.3 this is a moderate-severity, low-priority issue rather than an urgent threat: only a single low-severity outcome is realistic, with the public scoring signals disagreeing on whether that outcome is limited data disclosure (our assessed vector C:L/I:N) or limited data manipulation (the CNA vector I:L). There is no CISA KEV listing and no public exploit code identified at time of analysis, and the only public record is a Patchstack advisory entry, so exploitation in the field has not been observed. | MEDIUM | 5.3 | 0.2% | 27 |
No patch
|
| CVE-2026-97261 | Unauthenticated sensitive data exposure in the Notivo WordPress plugin (woo-notification) through version 1.4.2 allows remote attackers to retrieve limited confidential information from affected sites without authentication or user interaction. The CVSS vector (PR:N/UI:N) confirms the issue is remotely exploitable on a default installation, but impact is confined to low confidentiality (C:L) with no integrity or availability effect. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the plugin's narrow deployment footprint limits exposure relative to core WordPress. | MEDIUM | 5.3 | 0.3% | 26 |
No patch
|
| CVE-2026-102390 | Unauthorized affiliate action execution is possible in AFFI - Affiliate Marketing for WooCommerce through version 1.0.9 because an access-control check is missing, allowing unauthenticated remote attackers to perform a low-integrity action per CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. No public exploit code or CISA KEV entry was identified at time of analysis, so this is assessed as a modest-severity, integrity-only issue rather than an actively exploited urgent threat. The practical risk is abuse of the plugin's affiliate functionality on sites running the affected version. | MEDIUM | 5.3 | 0.2% | 26 |
No patch
|