Veille CVE

Jeudi 1 octobre 2026

9 CVE

Critique 0 Élevée 7 Moyenne 2 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « WooCommerce » ✕
  1. CVE-2026-97273 7.1 Élevée

    Premmerce Wishlist for WooCommerce

    Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.

  2. CVE-2026-97268 7.1 Élevée

    Premmerce Wishlist for WooCommerce

    Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.

  3. CVE-2026-94390 7.2 Élevée

    Dotstore Hide Shipping Method For WooCommerce

    Editor PHP Object Injection in Hide Shipping Method For WooCommerce <= 1.5.4 versions.

  4. CVE-2026-100517 7.5 Élevée

    VillaTheme Photo Reviews for WooCommerce

    Unauthenticated Insecure Direct Object References (IDOR) in Photo Reviews for WooCommerce <= 1.2.30 versions.

  5. CVE-2026-102390 5.3 Moyenne

    VillaTheme AFFI – Affiliate Marketing for WooCommerce

    Missing Authorization vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a through 1.0.9.

  6. CVE-2026-102379 8.5 Élevée

    VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Blind SQL Injection.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC Builder: from n/a through 1.0.28.

  7. CVE-2026-95687 8.8 Élevée

    wpclever WPC Shop as a Customer for WooCommerce

    The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0 This is due to the plugin not properly validating the target user's role prior to issuing a new authentication session, allowing an authenticated attacker to log in as any WordPress Administrator by directly supplying an Administrator's user ID to the wpcsa_login endpoint and receiving a full Administrator session cookie without supplying the Administrator's password. This makes it possible for authenticated attackers to perform a direct session takeover, gaining full Administrator-level access to the site.

  8. CVE-2026-92244 7.2 Élevée

    wpovernight PDF Invoices & Packing Slips for WooCommerce

    The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields in all versions up to, and including, 5.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload survives initial storage because WooCommerce's sanitize_text_field() and wc_clean() do not strip entity-encoded strings containing no literal '<' character, allowing unauthenticated guest-checkout orders to plant the malicious content.

  9. CVE-2026-12241 5.4 Moyenne

    mihail-barinov Advanced Woo Labels – Product Labels & Badges for WooCommerce

    The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to an improperly secure capability check on the 'save_meta_boxes' function in all versions up to, and including, 2.51. This makes it possible for authenticated attackers, with Contributor-level access and above, to create AWS labels that are rendered without proper escaping. The vulnerability was partially patched in version 2.46.