Veille CVE

Recherche « Unknown Verge3D Publishing and E-Commerce »

3 CVE

Critique 0 Élevée 1 Moyenne 2 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown Verge3D Publishing and E-Commerce » ✕
  1. CVE-2026-92994 8.8 Élevée

    Unknown Verge3D Publishing and E-Commerce

    The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded through its file storage feature and serves them back with an attacker-controlled content type, allowing unauthenticated attackers to store a file containing malicious JavaScript that executes in the browser of any user who opens it.

  2. CVE-2026-92996 5.3 Moyenne

    Unknown Verge3D Publishing and E-Commerce

    The Verge3D WordPress plugin from 4.1.0 through 4.13.0 does not verify with the payment provider that a payment was actually made, and does not check order ownership, allowing unauthenticated users to mark any order as paid.

  3. CVE-2026-92995 5.3 Moyenne

    Unknown Verge3D Publishing and E-Commerce

    The Verge3D Publishing and E-Commerce WordPress plugin through 4.13.0 does not restrict access to a file-download handler, allowing unauthenticated users to download the digital-goods files attached to any order without authorization.