Threat database

Missing Authorization vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a through 1.0.9.

CVE-2026-94171 is a high-severity DOM-based Cross-site Scripting (XSS) vulnerability in VillaTheme CURCY woo-multi-currency plugin version 2.2.18 and earlier. The flaw arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. This vulnerability impacts confidentiality, integrity, and availability of affected systems. No official patch or remediation information is provided in the available data.

Unauthenticated Sensitive Data Exposure in Notivo <= 1.4.2 versions.

CVE-2026-81786 is a high severity vulnerability in the VillaTheme Thank You Page Customizer for WooCommerce plugin. It involves missing authorization controls in versions up to 1.2.2, allowing unauthenticated users to access functionality that should be restricted. This vulnerability does not require user interaction and can be exploited remotely over the network.

Subscriber Cross Site Scripting (XSS) in Product Variations Swatches for WooCommerce <= 1.1.18 versions.

CVE-2026-82227 is a high-severity SQL Injection vulnerability affecting WPBulky plugin versions up to 1.2.2. The flaw allows improper neutralization of special elements in SQL commands via the Contributor functionality. This vulnerability can be exploited remotely with low attack complexity and requires low privileges. It impacts confidentiality with high severity and availability with low severity, but does not affect integrity. No official patch or remediation guidance is currently available from the vendor.

CVE-2026-81277 is a high-severity SQL Injection vulnerability in VillaTheme Suggestion Engine for WooCommerce versions up to 2.0.11. It allows an attacker with low privileges to execute SQL commands due to improper neutralization of special elements in SQL queries. This vulnerability can lead to high confidentiality impact and low availability impact but does not affect integrity. No official patch or remediation guidance is currently available.

Authentication Bypass Using an Alternate Path or Channel vulnerability in VillaTheme Abandoned Cart Recovery for WooCommerce woo-abandoned-cart-recovery allows Authentication Abuse.This issue affects Abandoned Cart Recovery for WooCommerce: from n/a through <= 1.1.12.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Bopo – WooCommerce Product Bundle Builder bopo-woo-product-bundle-builder allows Reflected XSS.This issue affects Bopo – WooCommerce Product Bundle Builder: from n/a through <= 1.2.0.

The The CURCY – Multi Currency for WooCommerce – Smoothly on WooCommerce 9.x plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.2.14. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

Unauthenticated Broken Authentication in ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce <= 2.2.0 versions.

Unauthenticated Sensitive Data Exposure in Bopo – WooCommerce Product Bundle Builder <= 1.1.6 versions.

Unauthenticated Broken Access Control in GIFT4U <= 1.0.10 versions.

VillaTheme GIFT4U versions up to and including 1.0.10 contain a critical SQL Injection vulnerability (CWE-89) that allows blind SQL injection attacks. This vulnerability can be exploited remotely without authentication and requires no user interaction. It impacts confidentiality and availability but does not affect integrity. No official patch or remediation guidance is currently available from the vendor.

Missing Authorization vulnerability in VillaTheme HAPPY allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects HAPPY: from n/a through 1.0.10.

Authorization Bypass Through User-Controlled Key vulnerability in VillaTheme COMPE compe-woo-compare-products allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects COMPE: from n/a through <= 1.1.4.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Abandoned Cart Recovery for WooCommerce woo-abandoned-cart-recovery allows Stored XSS.This issue affects Abandoned Cart Recovery for WooCommerce: from n/a through <= 1.1.10.

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in villatheme WooCommerce Photo Reviews woocommerce-photo-reviews allows Code Injection.This issue affects WooCommerce Photo Reviews: from n/a through <= 1.4.4.

Missing Authorization vulnerability in VillaTheme HAPPY happy-helpdesk-support-ticket-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HAPPY: from n/a through <= 1.0.8.

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in villatheme Sales Countdown Timer for WooCommerce and WordPress sctv-sales-countdown-timer allows PHP Local File Inclusion.This issue affects Sales Countdown Timer for WooCommerce and WordPress: from n/a through < 1.1.9.