Threats affecting pkg:composer/woocommerce/subscriptions

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Critical	9.8	EPSS 1.0%	CVE-2026-18391WooCommerce Subscriptions (WordPress plugin) · Code Injection Critical9.8EPSS 1.0%2026-08-12CVE Database V5CVE-2026-18391 The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain present in the bundled dependencies. EPSS 1.0%Vulnerability CWE-94 #ghsa-5736-34m2-3cxc	CVE Database V5	2026-08-12

Page 1 of 1