CVE Vulnerability Advisory Database

[Affected Scope] PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin versions up to, and including, 7.1.1

[Impact] Unauthenticated remote attackers can execute arbitrary PHP code on the server and fully compromise the system via malicious payload injection

[Mitigation] Immediately upgrade the plugin to the patched version (7.2.0 or higher) and apply input validation filters on checkout API requests

[Affected Scope] WooCommerce PDF Invoices & Packing Slips WordPress plugin up to and including version 5.16.5

[Impact] Unauthenticated attackers can extract complete PDF invoices of other customers, including billing/shipping addresses, order notes, and pricing, delivered directly to the attacker's email

[Mitigation] Immediately upgrade the plugin to version 5.16.6 or higher, and disable the yearly invoice number reset option as a temporary workaround

[Affected Scope] WordPress Discussion Board – WordPress Forum Plugin versions up to, and including, 2.6.0

[Impact] Authenticated attackers with subscriber-level access can inject arbitrary web scripts into the user profile Website field, executing in the browser of any user viewing the discussion topic

[Mitigation] Immediately update the Discussion Board plugin to the latest patched version (2.6.1 or higher)

[Affected Scope] WordPress WooCommerce PDF Invoices & Packing Slips plugin versions up to, and including, 5.16.4

[Impact] Unauthenticated attackers can inject arbitrary web scripts via billing and note parameters, leading to administrative session hijacking

[Mitigation] Immediately upgrade the plugin to the patched version (5.16.5 or higher) and apply WAF filtering rules

[Affected Scope] All versions up to, and including, 4.9.4 of the SureCart WordPress plugin

[Impact] Unauthenticated attackers can inject malicious scripts, potentially leading to administrator session hijacking and site defacement

[Mitigation] Immediately update the SureCart plugin to the latest secure version (4.9.5 or higher)

[Affected Scope] WordPress Core versions 4.7 through 7.1.3

[Impact] Unauthenticated attackers can execute arbitrary code on the server by exploiting predictable staging paths during the core upgrade process

[Mitigation] Immediately upgrade to WordPress 7.1.4 or later and restrict web access to the upgrade staging directories

[Affected Scope] Payment Forms for Paystack WordPress plugin versions before 4.0.6

[Impact] Users with Contributor role and above can view sensitive live and test Paystack API secret keys, granting full access to the site owner's payment account

[Mitigation] Immediately update the plugin to version 4.0.6 or higher and rotate all potentially exposed API secret keys

[Affected Scope] WordPress Ninja Forms plugin versions up to, and including, 3.15.5

[Impact] Unauthenticated attackers can inject malicious scripts via a single request, potentially leading to administrator session hijacking and site takeover

[Mitigation] Immediately update the Ninja Forms plugin to the latest secure version (3.15.6 or higher)

[Affected Scope] All versions of Meow Lightbox plugin for WordPress up to, and including, 5.6.4

[Impact] Unauthenticated attackers can inject arbitrary web scripts via the 'post_content' parameter, executing malicious JavaScript in the context of any user viewing the affected page under specific configurations

[Mitigation] Immediately update the Meow Lightbox plugin to the latest secure version (5.6.5 or higher) and apply temporary configuration workarounds if patching is delayed

[Affected Scope] Ninja Forms WordPress plugin versions up to, and including, 3.15.5

[Impact] Authenticated attackers with subscriber-level access can execute arbitrary shortcodes and potentially access sensitive data by manipulating their profile display name

[Mitigation] Immediately update the Ninja Forms plugin to the latest version (3.15.6 or higher) and review default field configurations

[Affected Scope] Ninja Forms WordPress plugin versions up to, and including, 3.15.5

[Impact] Unauthenticated attackers can execute arbitrary WordPress shortcodes, potentially leading to sensitive information disclosure or further exploitation

[Mitigation] Immediately update the Ninja Forms plugin to the latest secure version (3.15.6 or higher)

[Affected Scope] All IXP Manager versions prior to 7.3.0

[Impact] Authenticated non-admin users can elevate privileges to Administrator status, gaining full control over the IXP platform

[Mitigation] Immediate upgrade to version 7.3.0 or later is required

[Affected Scope] All IXP Manager installations prior to version 7.3.0.

[Impact] Authenticated attackers can view or modify API keys belonging to other users, potentially leading to full administrative takeover of the IXP infrastructure.

[Mitigation] Immediately upgrade IXP Manager to version 7.3.0 or later.

[Affected Scope] Network service components initially associated with CVE-2026-111477, now marked as Rejected or Withdrawn by the CNA.

[Impact] Initially assessed as High Severity (CVSS 7.5), potentially allowing remote attackers to compromise system Confidentiality, Integrity, and Availability.

[Mitigation] Verify the reason for rejection (e.g., duplicate ID) and ensure baseline network security controls are active to prevent similar exploitation.

[Affected Scope] YITH WooCommerce Product Add-Ons plugin versions 4.34.0 and below.

[Impact] Unauthenticated attackers can bypass authorization checks by manipulating user-controlled keys to modify data.

[Mitigation] Immediately update the plugin to version 4.35.0 or later.

[Affected Scope] Ad Inserter WordPress plugin versions 2.8.19 and below

[Impact] Unauthenticated remote attackers can inject malicious scripts to hijack admin sessions, deface websites, or conduct phishing attacks

[Mitigation] Immediately update the plugin to version 2.8.20 or later

[Affected Scope] Booktics WordPress plugin versions up to 1.0.31.

[Impact] Authenticated users with low privileges can access unauthorized data or functions due to broken access control.

[Mitigation] Update to the latest version (1.0.32 or higher) immediately.

[Affected Scope] All websites and e-commerce stores running Vvveb CMS versions prior to 1.0.8.7

[Impact] Remote attackers can bypass authentication to reset any user's password, leading to full account takeover including administrative privileges.

[Mitigation] Immediately upgrade Vvveb CMS to version 1.0.8.7 or later.

[Affected Scope] Netsweeper versions prior to 4.0.11 and 4.1.0 through 4.1.4.

[Impact] Remote attackers can execute arbitrary JavaScript in the victim's browser, potentially leading to administrative session hijacking.

[Mitigation] Immediately upgrade Netsweeper to version 4.0.11, 4.1.5, or later.

[Affected Scope] All DedeCMS installations prior to version 5.7

[Impact] Remote unauthenticated attackers can disclose sensitive local files or system configurations via path traversal sequences

[Mitigation] Upgrade to DedeCMS 5.7 or later, or manually patch the uninitialized variable in the affected PHP script