| CVE ID | Title | Vendor | Product | Severity | CVSS Score | Published At | AI Analysis |
|---|---|---|---|---|---|---|---|
| CVE-2026-94360 | Paymentfor Gateway for WooCommerce < 1.0.6 - Unauthenticated Order Payment Forgery via Unverified Card Callbacks | Unknown | Paymentfor Gateway for WooCommerce | - | - | 2026-10-14 06:00:16 | Deep Dive |
| CVE-2026-96900 | Cart Abandonment Recovery for WooCommerce < 2.1.4 - Unauthenticated Abandoned Cart Record Deletion and Modification via IDOR | Unknown | Cart Abandonment Recovery for WooCommerce | - | - | 2026-10-14 06:00:16 | Deep Dive |
| CVE-2026-96904 | AWP Classifieds < 4.4.9 - Unauthenticated Listing Contact Email Disclosure via Place Ad Page | Unknown | AWP Classifieds | - | - | 2026-10-14 06:00:16 | Deep Dive |
| CVE-2026-89288 | Fast Courier 5.0.0 - 5.2.3 - Unauthenticated SQLi via 'wp_order_id' Parameter | Unknown | Fast Courier | - | - | 2026-10-14 06:00:15 | Deep Dive |
| CVE-2026-92409 | Donation Thermometer 2.2.9 - 2.2.11 - Contributor+ Stored XSS via Shortcode | Unknown | Donation Thermometer | - | - | 2026-10-14 06:00:15 | Deep Dive |
| CVE-2026-92426 | YITH WooCommerce Popup < 1.60.0 - Contributor+ Arbitrary Post Meta Deletion | Unknown | YITH WooCommerce Popup | - | - | 2026-10-14 06:00:15 | Deep Dive |
| CVE-2026-90989 | Tainacan < 1.4.0 - Subscriber+ Repository Staff Email Address Disclosure via Reports REST Endpoints | Unknown | Tainacan | - | - | 2026-10-14 06:00:15 | Deep Dive |
| CVE-2026-91076 | Robokassa payment for WooCommerce < 1.9.0 - Unauthenticated Arbitrary Order Status Change to Failed | Unknown | Robokassa payment gateway for Woocommerce | - | - | 2026-10-14 06:00:15 | Deep Dive |
| CVE-2026-87968 | Product Feed for Google Shopping < 5.3.2 - Unauthenticated Forced Store Registration | Unknown | Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant | - | - | 2026-10-14 06:00:14 | Deep Dive |
| CVE-2026-87843 | Trust Payments Gateway for WooCommerce < 3.1.0 - Unauthenticated Order Payment Completion via Payment Return Page | Unknown | Trust Payments Gateway for WooCommerce | - | - | 2026-10-14 06:00:14 | Deep Dive |
| CVE-2026-87974 | Asaas Gateway for WooCommerce < 2.7.8 - Unauthenticated Order Payment Bypass via Webhook | Unknown | Asaas Gateway for WooCommerce | - | - | 2026-10-14 06:00:14 | Deep Dive |
| CVE-2026-88927 | rtMedia for WordPress, BuddyPress and bbPress < 4.7.14 - Subscriber+ Arbitrary Album Media Injection via IDOR | Unknown | rtMedia for WordPress, BuddyPress and bbPress | - | - | 2026-10-14 06:00:14 | Deep Dive |
| CVE-2026-86799 | Forms < 3.0.2 - Unauthenticated Stored XSS via Form Submission | Unknown | Forms | - | - | 2026-10-14 06:00:14 | Deep Dive |
| CVE-2026-85345 | FV Player 7.5.44.7212 - 7.5.54.7212 - Contributor+ SSRF via retrieve_video_data | Unknown | FV Flowplayer Video Player | - | - | 2026-10-14 06:00:13 | Deep Dive |
| CVE-2026-85000 | EmbedPress < 4.6.8 - Unauthenticated YouTube API Quota Consumption and Database Bloating | Unknown | EmbedPress | - | - | 2026-10-14 06:00:13 | Deep Dive |
| CVE-2026-86787 | Affiliate Toolkit 3.8.7 - 3.9.0 - Contributor+ RCE via BladeOne @php Directive | Unknown | affiliate-toolkit | - | - | 2026-10-14 06:00:13 | Deep Dive |
| CVE-2026-86797 | Pricing Table Block 1.0.7 - 2.1.4 - Contributor+ Stored XSS via Pricing Link | Unknown | Pricing Table | - | - | 2026-10-14 06:00:13 | Deep Dive |
| CVE-2026-108064 | WP Encryption < 7.8.8.2 - Unauthenticated Certificate Private Key and ACME Order Replacement via wple_auto_handler | Unknown | WP Encryption | - | - | 2026-10-14 06:00:12 | Deep Dive |
| CVE-2026-108069 | Sunshine Photo Cart < 3.7.4 - Unauthenticated Content Injection via sunshine_modal_add_comment() | Unknown | Sunshine Photo Cart | - | - | 2026-10-14 06:00:12 | Deep Dive |
| CVE-2026-108066 | WP 2FA < 4.2.0 - Admin+ Arbitrary User 2FA Removal via IDOR | Unknown | WP 2FA | - | - | 2026-10-14 06:00:12 | Deep Dive |