CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
WooCommerce PDF Invoice Plugin PHP Object Injection and Remote Code Execution (RCE) Vulnerability (CVE-2026-109220)
[Affected Scope] PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin versions up to, and including, 7.1.1
[Impact] Unauthenticated remote attackers can execute arbitrary PHP code on the server and fully compromise the system via malicious payload injection
[Mitigation] Immediately upgrade the plugin to the patched version (7.2.0 or higher) and apply input validation filters on checkout API requests
WordPress REST API Route Confusion and SQL Injection Chaining Remote Code Execution Vulnerability (CVE-2026-63030)
[Affected Scope] WordPress versions 6.9.x before 6.9.5, and 7.0.x before 7.0.2
[Impact] Unauthenticated attackers can exploit a REST API batch endpoint route confusion vulnerability, chaining it with the WP_Query SQL Injection (CVE-2026-60137) to compromise the database and achieve Remote Code Execution (RCE)
[Mitigation] Immediately upgrade WordPress core to patched versions (6.9.5, 7.0.2, or later), or temporarily disable the REST API batch endpoint and apply WAF rules