25
CVEs
1
Critical
10
High
0
KEV
0
PoC
11
Unpatched C/H
0.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
10
MEDIUM
13
LOW
1
Monthly CVE Trend
Affected Products (30)
Wordpress Plugin
39
Woocommerce
11
Photo Reviews For Woocommerce
5
Curcy
3
Abandoned Cart Recovery For Woocommerce
3
Ald Dropshipping And Fulfillment For Aliexpress And Woocommerce
2
Buildkit Product Builder For Woocommerce Custom Pc Builder
2
Thank You Page Customizer For Woocommerce
2
Gift4U
2
Bopo Woocommerce Product Bundle Builder
2
Wpbulky
2
Woocommerce Thank You Page Customizer
2
Affi Affiliate Marketing For Woocommerce
2
Tmds
1
PHP
1
Suggestion Engine For Woocommerce
1
S2W Import Shopify To Woocommerce
1
W2S
1
Orders Tracking For Woocommerce
1
Customer Coupons For Woocommerce
1
Dropshipping And Fulfillment For Aliexpress And Woocommerce
1
Product Variations Swatches For Woocommerce
1
Product Size Chart For Woocommerce
1
Curcy Multi Currency For Woocommerce Smoothly On Woocommerce 9 X
1
Woocommerce Email Template Customizer
1
Happy
1
Salevo
1
Lookzy
1
Woocommerce Multi Currency
1
Exmage
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-104398 | Unauthenticated PHP Object Injection in the AFFI - Affiliate Marketing for WooCommerce WordPress plugin (all versions through 1.0.10) allows remote attackers to pass crafted serialized data to PHP unserialize(), enabling arbitrary object instantiation that could lead to remote code execution, file manipulation, or data theft if a viable POP gadget chain exists in the plugin, WordPress core, WooCommerce, or other installed extensions. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required to reach the vulnerable code path, but the independent assessment notes that real-world severity depends heavily on the presence of a usable gadget chain, making the nominal 9.8 score more nuanced in practice. No public exploit identified at time of analysis, and no CISA KEV listing was provided in the intelligence; the sole reference is the Patchstack vulnerability database entry. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2026-81277 | SQL Injection in VillaTheme's Suggestion Engine for WooCommerce plugin (versions ≤ 2.0.11) enables contributor-level authenticated WordPress users to inject malicious SQL through the suggestion engine functionality. The CVSS scope-change indicator (S:C) confirms the injection can reach data beyond the plugin's own tables, exposing the broader WordPress MySQL database with high confidentiality impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, low-privilege attack profile makes this a credible threat on any WordPress/WooCommerce site that permits contributor accounts. | HIGH | 8.5 | 0.3% | 43 |
No patch
|
| CVE-2026-82227 | SQL injection in WPBulky WordPress plugin (versions ≤ 1.2.2) is exploitable by any authenticated user holding a Contributor-level role, requiring no user interaction and no special configuration beyond plugin installation. The CVSS Scope:Changed flag combined with high confidentiality impact indicates the injection can reach beyond WordPress application data into the underlying MySQL database, enabling extraction of password hashes, private content, and any other data accessible to the database user. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, low-privilege attack vector makes this a realistic threat on sites with open user registration. | HIGH | 8.5 | 0.2% | 42 |
No patch
|
| CVE-2026-102379 | Blind SQL injection in the VillaTheme BuildKit - Product Builder for WooCommerce - Custom PC Builder WordPress plugin (all versions through 1.0.28) lets an authenticated, low-privilege user on a WooCommerce site inject SQL into plugin-supplied queries and infer database contents one bit at a time. Because the injection is blind, extraction is slow but still permits disclosure of high-impact data such as WordPress user hashes, customer records, and WooCommerce order details. The flaw rates CVSS 3.1 8.5 (HIGH) with remote reachability, low attack complexity, and no user interaction, and the primary barrier is the requirement for a valid low-privileged account (PR:L). No public exploit code and no confirmed active exploitation were identified at time of analysis. | HIGH | 8.5 | 0.2% | 42 |
No patch
|
| CVE-2026-101923 | Unauthenticated attackers can permanently delete arbitrary posts, pages, products, and media attachments on any WordPress site running the Photo Reviews for WooCommerce plugin through version 1.2.30. The plugin accepts attacker-controlled post IDs in the public wcpr_image_upload_id parameter of a review submission and stores them as the review's 'reviews-images' comment meta without verifying that those IDs belong to attachments owned by the submitter; when the review is later deleted, the delete_reviews_image() handler unconditionally calls wp_delete_post( $id, true ) on every stored ID. Because the trigger is a privileged action - an administrator deleting the planted review, or WordPress's built-in wp_scheduled_delete cron emptying the comment trash roughly 30 days after the review is trashed - this is a credible high-integrity, high-availability issue rather than an instantly weaponizable one, and no public exploit code or CISA KEV entry was identified at time of analysis. | HIGH | 8.1 | 0.3% | 41 |
No patch
|
| CVE-2026-103071 | Unauthenticated code injection in the VillaTheme 'Thank You Page Customizer for WooCommerce' plugin, versions up to and including 1.2.3, lets a remote attacker who can reach a site running the plugin cause arbitrary code to be generated and executed, primarily threatening the integrity of the WordPress installation (CVSS 3.1 base 7.5, vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N per independent assessment). Any store that has both WooCommerce and this specific plugin installed and active is exposed, requires no credentials or user interaction, and is exploitable against default configurations. At time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified, and no vendor-released fixed version was found in the available data, so the practical risk is bounded by the narrow deployment scope of this relatively uncommon plugin rather than by any mass-exploitation signal. | HIGH | 7.5 | 0.2% | 38 |
No patch
|
| CVE-2026-81786 | Broken access control in the VillaTheme Thank You Page Customizer for WooCommerce plugin (all versions through 1.2.2) exposes WooCommerce order data to unauthenticated remote attackers. The missing authorization check (CWE-862) on one or more plugin endpoints allows any network-reachable party to retrieve order-associated confidential data without credentials, consistent with the CVSS C:H/PR:N/UI:N vector reported by Patchstack. No public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 7.5 | 0.2% | 38 |
No patch
|
| CVE-2026-100517 | Unauthenticated Insecure Direct Object Reference (IDOR) in the Photo Reviews for WooCommerce WordPress plugin, affecting all versions up to and including 1.2.30, allows remote attackers with no credentials and no user interaction to reference objects they should not be authorized to reach, degrading availability of the affected site's review functionality (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Exploitation requires only that the plugin be installed and active on a network-reachable WordPress/WooCommerce installation; no special feature toggle or non-default configuration is named in the advisory. There is no public exploit code identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), so exposure is currently driven by the low attack complexity and the unauthenticated, remote nature of the flaw rather than by observed in-the-wild activity. | HIGH | 7.5 | 0.3% | 38 |
No patch
|
| CVE-2026-100161 | Stored DOM-based cross-site scripting in the VillaTheme Photo Reviews for WooCommerce plugin through version 1.2.30 lets unauthenticated visitors inject arbitrary web scripts into review-related comment meta, which execute when a shopper or admin later loads a product page displaying the affected review. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, and the only gate is the publicly emitted `wcpr_image_upload` nonce, so no authentication, capability, or attachment-ownership check is required. No public exploit identified at time of analysis, and there is no CISA KEV confirmation of active exploitation. | HIGH | 7.2 | 0.3% | 36 |
No patch
|
| CVE-2026-94171 | Unauthenticated cross-site scripting in the CURCY (Woo Multi Currency) plugin for WordPress, affecting all versions up to and including 2.2.16, allows remote attackers to inject and execute arbitrary script in the context of a victim's browsing session. Exploitation is network-reachable and low-complexity and requires no authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 7.1), but it does require victim user interaction - the target must click a crafted link or otherwise render attacker-controlled content - and it only affects WordPress sites where the vulnerable plugin is installed and active. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied; the practical exposure is therefore driven by user interaction and by how many sites still run CURCY at or below 2.2.16. | HIGH | 7.1 | 0.3% | 36 |
No patch
|
| CVE-2026-100515 | Reflected cross-site scripting (XSS) in the VillaTheme 'Photo Reviews for WooCommerce' plugin for WordPress affects all versions through 1.2.30, allowing an unauthenticated attacker to inject script into a page viewed by a victim. Exploitation is phishing-driven: the attacker must lure a targeted visitor to a crafted URL, and the payload executes only in that victim's browser session, giving CVSS 3.1 a base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) rather than server-wide compromise. No public exploit code identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); the vulnerability was reported by Patchstack and the exact vulnerable parameter or endpoint is not detailed in the available data. | HIGH | 7.1 | 0.2% | 36 |
No patch
|
| CVE-2026-103357 | Missing authorization in VillaTheme GIFT4U (gift4u-gift-cards-all-in-one-for-woo) versions 1.1.3 and earlier allows unauthenticated remote attackers to tamper with limited gift-card-related data on WordPress/WooCommerce sites where the plugin is active. The flaw (CWE-862) stems from the plugin failing to enforce an access-control check on a restricted function, and per the CVSS vector (PR:N/UI:N) no authentication or user interaction is required. No public exploit code or active exploitation has been identified at time of analysis, and the impact is limited to integrity (VI:L) with no confidentiality or availability impact, resulting in a medium-severity rating. | MEDIUM | 6.9 | 0.3% | 35 |
No patch
|
| CVE-2026-102383 | Missing authorization checks (CWE-862) in the VillaTheme Lookzy / woo-lookbook WordPress plugin, versions up to and including 1.1.14, let remote unauthenticated attackers invoke plugin functionality that should be protected by access-control and capability checks. Affected sites are those running the plugin (typically alongside WooCommerce) on internet-reachable WordPress installations; per the assessed vector AV:N/AC:L/PR:N/UI:N, exploitation is remote, unauthenticated, and requires no user interaction. Impact is bounded to the plugin's own functionality (integrity and availability low, confidentiality none), and no public exploit code has been identified at time of analysis, so the practical risk is constrained by the narrow population of sites running this specific plugin. | MEDIUM | 6.5 | 0.3% | 33 |
No patch
|
| CVE-2026-81282 | Stored Cross-Site Scripting in VillaTheme's Product Variations Swatches for WooCommerce plugin (versions <= 1.1.18) allows authenticated subscribers to inject malicious JavaScript that executes in the browsers of higher-privileged users, such as administrators, when they view affected content. The flaw stems from insufficient input sanitization or output escaping of subscriber-controllable data processed by the plugin's variation swatch rendering logic. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, though the low authentication bar - subscriber role - expands the potential attacker pool on any store permitting public registration. | MEDIUM | 6.5 | 0.2% | 33 |
No patch
|
| CVE-2026-103356 | Authenticated users with only low privileges (for example a WordPress subscriber or registered WooCommerce customer) can reach at least one TMDS dropshipping plugin action that performs no authorization check, allowing them to make unauthorized state changes against a WordPress site running TMDS 1.0.15 or earlier. The vendor-assigned CVSS of 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) reflects limited integrity and availability impact with no confidentiality loss, and exploitation requires a valid low-privilege account, so the practical risk is moderate rather than critical. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and no EPSS or CISA KEV data was supplied; only a Patchstack advisory (credited as the reporting source) documents the issue. | MEDIUM | 5.4 | 0.2% | 27 |
No patch
|