Veille CVE

Lundi 5 octobre 2026

7 CVE

Critique 0 Élevée 2 Moyenne 5 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « WooCommerce » ✕
  1. CVE-2026-97275 5.3 Moyenne

    VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder

    Improper Validation of Specified Quantity in Input vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Input Data Manipulation.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC Builder: from n/a through 1.0.28.

  2. CVE-2026-103349 7.2 Élevée

    Rymera Web Co Product Feed PRO for WooCommerce

    Deserialization of Untrusted Data vulnerability in Rymera Web Co Product Feed PRO for WooCommerce woo-product-feed-pro allows Object Injection.This issue affects Product Feed PRO for WooCommerce: from n/a through 13.5.7.

  3. CVE-2026-100515 7.1 Élevée

    VillaTheme Photo Reviews for WooCommerce

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Reflected XSS.This issue affects Photo Reviews for WooCommerce: from n/a through 1.2.30.

  4. CVE-2026-105421 5.3 Moyenne

    Kit (formerly ConvertKit) for WooCommerce

    Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) for WooCommerce convertkit-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit) for WooCommerce: from n/a through 2.2.0.

  5. CVE-2026-103351 5.3 Moyenne

    Magepeople inc. Taxi Booking Manager for WooCommerce

    Improper Validation of Specified Quantity in Input vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Input Data Manipulation.This issue affects Taxi Booking Manager for WooCommerce: from n/a through 2.1.1.

  6. CVE-2026-78371 5.9 Moyenne

    Unknown File Uploads Addon for WooCommerce

    The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requesting a customer-uploaded file is the customer who uploaded it, allowing unauthenticated attackers who know or guess a file's name to download other customers' uploaded files.

  7. CVE-2026-13607 5.9 Moyenne

    Unknown File Uploads Addon for WooCommerce

    The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve customer-uploaded files directly, bypassing the File Uploads Addon for WooCommerce WordPress plugin through 1.7.6's authenticated download mechanism.