Threat database

CVE-2026-103081 is a high-severity code injection vulnerability in VillaTheme Salevo woo-boost-sales plugin. It affects versions from initial release up to 1.3.0. The vulnerability allows an attacker to inject code due to improper control of code generation. The CVSS score is 7.5, indicating a network exploitable issue with high impact on confidentiality but no impact on integrity or availability. No known exploits are reported in the wild. No patch or remediation information is provided in the available data.

CVE-2026-103358 is a code injection vulnerability in the VillaTheme Email Template Customizer for WooCommerce plugin. It affects versions from the initial release up to and including 1.3.4. The vulnerability allows an attacker to inject code remotely without requiring privileges or user interaction. This can lead to high confidentiality impact but does not affect integrity or availability. No official patch or remediation information is provided in the input data.

CVE-2026-103080 is a medium severity vulnerability in VillaTheme Salevo woo-boost-sales plugin that allows external control of an assumed-immutable web parameter, leading to input data manipulation. It affects versions from initial release up to 1.3.0. The vulnerability does not impact confidentiality or availability but can affect data integrity. No known exploits are reported in the wild. No patch or remediation information is currently provided.

Missing Authorization vulnerability in VillaTheme TMDS tmds-dropshipping-for-temu-and-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TMDS: from n/a through 1.0.15.

CVE-2026-103685 is a missing authorization vulnerability in the VillaTheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce plugin. It affects versions from the initial release up to 2.2.4. The flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability has a medium severity rating with a CVSS score of 4.3. No official patch or remediation information is provided in the available data.

CVE-2026-104398 is a critical deserialization of untrusted data vulnerability in the VillaTheme AFFI – Affiliate Marketing for WooCommerce plugin. This flaw allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability. It affects versions from initial release up to 1.0.10 inclusive. No patch or remediation information is provided in the source data.

CVE-2026-103071 is a high-severity vulnerability in the VillaTheme Thank You Page Customizer for WooCommerce plugin. It allows an attacker to perform code injection due to improper control of code generation. This affects versions from initial releases up to 1.2.3 inclusive. The vulnerability has a CVSS score of 7.5, indicating it can be exploited remotely without authentication and requires no user interaction. There is no information about a patch or fix being available at this time.

CVE-2026-103357 is a missing authorization vulnerability in the VillaTheme GIFT4U plugin for WooCommerce. It affects versions from the initial release up to 1.1.3. The flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability has a medium severity rating with a CVSS score of 6.9. No official patch or remediation details are provided in the available data.

The Photo Reviews for WooCommerce WordPress plugin up to version 1.2.30 is vulnerable to stored DOM-based cross-site scripting (XSS) via the 'wcpr_image_upload_id' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users view the affected review pages. The issue arises from insufficient input sanitization and output escaping, with no authentication or ownership checks on the stored comment meta data where the payload is saved.

Missing Authorization vulnerability in VillaTheme VillaTheme Core villatheme-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VillaTheme Core: from n/a through 1.0.5.

CVE-2026-97275 is a medium severity vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder. It involves improper validation of specified quantity in input, allowing input data manipulation. The issue affects versions from initial releases up to 1.0.28 inclusive. There is no indication of confidentiality or availability impact, but integrity may be affected due to input manipulation. No official patch or remediation information is provided in the source data.

CVE-2026-100515 is a reflected cross-site scripting (XSS) vulnerability in VillaTheme Photo Reviews for WooCommerce. It affects versions from initial release up to 1.2.30. The vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to execute arbitrary scripts in users' browsers. The CVSS score is 7.1, indicating a high severity level. No official patch or vendor advisory is provided in the input data.

CVE-2026-102383 is a missing authorization vulnerability in VillaTheme Lookzy (woo-lookbook) that affects versions from initial release up to 1.1.14. The flaw allows unauthorized users to exploit incorrectly configured access control security levels, potentially leading to integrity and availability impacts. The vulnerability has a medium severity rating with a CVSS score of 6.5.

CVE-2026-97071 is an incorrect calculation vulnerability in the VillaTheme CURCY woo-multi-currency plugin that allows integer attacks. It affects versions from the initial release up to 2.2.17. The vulnerability has a medium severity rating with a CVSS score of 5.3. There is no indication of known exploits in the wild or an official patch available at this time.

The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Arbitrary Content Deletion in versions up to, and including, 1.2.30. This is due to the plugin storing attacker-controlled post IDs from the wcpr_image_upload_id parameter of a public review submission into the review's reviews-images comment meta without verifying that the IDs correspond to attachments owned by the submitter, combined with the delete_reviews_image() handler unconditionally calling wp_delete_post( $id, true ) on every stored ID when the review is deleted. This makes it possible for unauthenticated attackers to permanently delete arbitrary posts, pages, products, or media attachments on the site whenever an administrator subsequently deletes the attacker's review (or when WordPress's built-in wp_scheduled_delete cron empties the comment trash after 30 days).

Unauthenticated Insecure Direct Object References (IDOR) in Photo Reviews for WooCommerce <= 1.2.30 versions.

CVE-2026-102379 is a high-severity SQL Injection vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder. It allows an attacker with low privileges to perform blind SQL injection, potentially leading to data confidentiality loss and partial service disruption. The vulnerability affects all versions from the initial release up to 1.0.28 inclusive.