Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-116856 (GCVE-0-2026-116856)

Vulnerability from nvd – Published: 2026-10-29 14:24 – Updated: 2026-10-29 16:49 X_Open Source

Title

WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.24 - Broken Access Control vulnerability

Summary

Missing Authorization vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Quantity – Measurement Price Calculator for WooCommerce: from n/a through 2.3.24.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-29 14:34 UTC

CWE

CWE-862 - Missing Authorization

Assigner

Patchstack CNA under the mitre root

CNA scorecard B 75/100 over 3323 records in the last 180 days details

References

1 reference

URL	Tags
https://patchstack.com/database/wordpress/plugin/…	vdb-entry

Impacted products

1 product

Vendor	Product	Version
WP Desk	Flexible Quantity – Measurement Price Calculator for WooCommerce	Affected: 0 , ≤ 2.3.24 (custom)

Date Public

2026-10-29 14:24

Credits

Peter Tang | Patchstack Bug Bounty Program

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-116856",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T14:34:57.861744Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T16:49:19.958Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "flexible-quantity-measurement-price-calculator-for-woocommerce",
          "product": "Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce",
          "vendor": "WP Desk",
          "versions": [
            {
              "changes": [
                {
                  "at": "2.3.25",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "2.3.24",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Tang | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-10-29T14:24:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in WP Desk Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce: from n/a through 2.3.24.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in WP Desk Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce: from n/a through 2.3.24."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T14:24:43.724Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/flexible-quantity-measurement-price-calculator-for-woocommerce/vulnerability/wordpress-flexible-quantity-measurement-price-calculator-for-woocommerce-plugin-2-3-24-broken-access-control-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce plugin to the latest available version (at least 2.3.25)."
            }
          ],
          "value": "Update the WordPress Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce plugin to the latest available version (at least 2.3.25)."
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "WordPress Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce plugin \u003c= 2.3.24 - Broken Access Control vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-116856",
    "datePublished": "2026-10-29T14:24:43.173Z",
    "dateReserved": "2026-10-27T00:20:51.129Z",
    "dateUpdated": "2026-10-29T16:49:19.958Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-115601 (GCVE-0-2026-115601)

Vulnerability from nvd – Published: 2026-10-29 14:31 – Updated: 2026-10-30 18:50 X_Open Source

Title

WordPress Custom Price for WooCommerce plugin <= 1.1.29 - Broken Access Control vulnerability

Summary

Missing Authorization vulnerability in WP Desk Custom Price for WooCommerce custom-price-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Price for WooCommerce: from n/a through 1.1.29.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-30 18:39 UTC

CWE

CWE-862 - Missing Authorization

Assigner

Patchstack CNA under the mitre root

CNA scorecard B 75/100 over 3323 records in the last 180 days details

References

1 reference

URL	Tags
https://patchstack.com/database/wordpress/plugin/…	vdb-entry

Impacted products

1 product

Vendor	Product	Version
WP Desk	Custom Price for WooCommerce	Affected: 0 , ≤ 1.1.29 (custom)

Date Public

2026-10-29 14:31

Credits

ssophiz | Patchstack Bug Bounty Program

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-115601",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-30T18:39:42.979095Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-30T18:50:05.850Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "custom-price-for-woocommerce",
          "product": "Custom Price for WooCommerce",
          "vendor": "WP Desk",
          "versions": [
            {
              "changes": [
                {
                  "at": "1.1.30",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "1.1.29",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "ssophiz | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-10-29T14:31:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in WP Desk Custom Price for WooCommerce custom-price-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects Custom Price for WooCommerce: from n/a through 1.1.29.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in WP Desk Custom Price for WooCommerce custom-price-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Price for WooCommerce: from n/a through 1.1.29."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T14:33:00.541Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/custom-price-for-woocommerce/vulnerability/wordpress-custom-price-for-woocommerce-plugin-1-1-29-broken-access-control-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress Custom Price for WooCommerce plugin to the latest available version (at least 1.1.30)."
            }
          ],
          "value": "Update the WordPress Custom Price for WooCommerce plugin to the latest available version (at least 1.1.30)."
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "WordPress Custom Price for WooCommerce plugin \u003c= 1.1.29 - Broken Access Control vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-115601",
    "datePublished": "2026-10-29T14:31:58.839Z",
    "dateReserved": "2026-10-23T00:18:53.712Z",
    "dateUpdated": "2026-10-30T18:50:05.850Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-114195 (GCVE-0-2026-114195)

Vulnerability from nvd – Published: 2026-10-22 08:48 – Updated: 2026-10-22 10:56 X_Open Source

Title

WordPress ShopMagic plugin <= 4.9.1 - Sensitive Data Exposure vulnerability

Summary

Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in WP Desk ShopMagic shopmagic-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects ShopMagic: from n/a through 4.9.1.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-22 10:46 UTC

CWE

CWE-538 - Insertion of Sensitive Information into Externally-Accessible File or Directory

Assigner

Patchstack CNA under the mitre root

CNA scorecard B 75/100 over 3323 records in the last 180 days details

References

1 reference

URL	Tags
https://patchstack.com/database/wordpress/plugin/…	vdb-entry

Impacted products

1 product

Vendor	Product	Version
WP Desk	ShopMagic	Affected: 0 , ≤ 4.9.1 (custom)

Date Public

2026-10-22 08:48

Credits

dcs | Patchstack Bug Bounty Program

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-114195",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-22T10:46:03.066910Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-22T10:56:13.370Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "shopmagic-for-woocommerce",
          "product": "ShopMagic",
          "vendor": "WP Desk",
          "versions": [
            {
              "changes": [
                {
                  "at": "4.9.2",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "4.9.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "dcs | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-10-22T08:48:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in WP Desk ShopMagic shopmagic-for-woocommerce allows Retrieve Embedded Sensitive Data.\u003cp\u003eThis issue affects ShopMagic: from n/a through 4.9.1.\u003c/p\u003e"
            }
          ],
          "value": "Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in WP Desk ShopMagic shopmagic-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects ShopMagic: from n/a through 4.9.1."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-37",
          "descriptions": [
            {
              "lang": "en",
              "value": "Retrieve Embedded Sensitive Data"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-538",
              "description": "Insertion of Sensitive Information into Externally-Accessible File or Directory",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T08:49:20.847Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/shopmagic-for-woocommerce/vulnerability/wordpress-shopmagic-plugin-4-9-1-sensitive-data-exposure-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress ShopMagic plugin to the latest available version (at least 4.9.2)."
            }
          ],
          "value": "Update the WordPress ShopMagic plugin to the latest available version (at least 4.9.2)."
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "WordPress ShopMagic plugin \u003c= 4.9.1 - Sensitive Data Exposure vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-114195",
    "datePublished": "2026-10-22T08:48:20.446Z",
    "dateReserved": "2026-10-21T00:23:03.976Z",
    "dateUpdated": "2026-10-22T10:56:13.370Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-110364 (GCVE-0-2026-110364)

Vulnerability from nvd – Published: 2026-10-15 18:16 – Updated: 2026-10-15 20:39 X_Open Source

Title

WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.23 - Broken Access Control vulnerability

Summary

Missing Authorization vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Quantity – Measurement Price Calculator for WooCommerce: from n/a through 2.3.23.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 20:37 UTC

CWE

CWE-862 - Missing Authorization

Assigner

Patchstack CNA under the mitre root

CNA scorecard B 75/100 over 3323 records in the last 180 days details

References

1 reference

URL	Tags
https://patchstack.com/database/wordpress/plugin/…	vdb-entry

Impacted products

1 product

Vendor	Product	Version
WP Desk	Flexible Quantity – Measurement Price Calculator for WooCommerce	Affected: 0 , ≤ 2.3.23 (custom)

Date Public

2026-10-15 18:16

Credits

myhappyhoon | Patchstack Bug Bounty Program

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-110364",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T20:37:04.225423Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T20:39:16.095Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "flexible-quantity-measurement-price-calculator-for-woocommerce",
          "product": "Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce",
          "vendor": "WP Desk",
          "versions": [
            {
              "changes": [
                {
                  "at": "2.3.24",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "2.3.23",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "myhappyhoon | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-10-15T18:16:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in WP Desk Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce: from n/a through 2.3.23.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in WP Desk Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce: from n/a through 2.3.23."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T18:17:52.800Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/flexible-quantity-measurement-price-calculator-for-woocommerce/vulnerability/wordpress-flexible-quantity-measurement-price-calculator-for-woocommerce-plugin-2-3-23-broken-access-control-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce plugin to the latest available version (at least 2.3.24)."
            }
          ],
          "value": "Update the WordPress Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce plugin to the latest available version (at least 2.3.24)."
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "WordPress Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce plugin \u003c= 2.3.23 - Broken Access Control vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-110364",
    "datePublished": "2026-10-15T18:16:51.303Z",
    "dateReserved": "2026-10-14T00:22:17.448Z",
    "dateUpdated": "2026-10-15T20:39:16.095Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107869 (GCVE-0-2026-107869)

Vulnerability from nvd – Published: 2026-10-12 08:25 – Updated: 2026-10-12 11:40 X_Open Source

Title

WordPress Flexible Subscriptions plugin <= 1.8.4 - Broken Access Control vulnerability

Summary

Missing Authorization vulnerability in WP Desk Flexible Subscriptions flexible-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Subscriptions: from n/a through 1.8.4.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-12 11:31 UTC

CWE

CWE-862 - Missing Authorization

Assigner

Patchstack CNA under the mitre root

CNA scorecard B 75/100 over 3323 records in the last 180 days details

References

1 reference

URL	Tags
https://patchstack.com/database/wordpress/plugin/…	vdb-entry

Impacted products

1 product

Vendor	Product	Version
WP Desk	Flexible Subscriptions	Affected: 0 , ≤ 1.8.4 (custom)

Date Public

2026-10-12 08:25

Credits

Ivan | Patchstack Bug Bounty Program

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107869",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-12T11:31:13.269475Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-12T11:40:34.088Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "flexible-subscriptions",
          "product": "Flexible Subscriptions",
          "vendor": "WP Desk",
          "versions": [
            {
              "changes": [
                {
                  "at": "1.8.5",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "1.8.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ivan | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-10-12T08:25:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in WP Desk Flexible Subscriptions flexible-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects Flexible Subscriptions: from n/a through 1.8.4.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in WP Desk Flexible Subscriptions flexible-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Subscriptions: from n/a through 1.8.4."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T08:26:50.077Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/flexible-subscriptions/vulnerability/wordpress-flexible-subscriptions-plugin-1-8-4-broken-access-control-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress Flexible Subscriptions plugin to the latest available version (at least 1.8.5)."
            }
          ],
          "value": "Update the WordPress Flexible Subscriptions plugin to the latest available version (at least 1.8.5)."
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "WordPress Flexible Subscriptions plugin \u003c= 1.8.4 - Broken Access Control vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-107869",
    "datePublished": "2026-10-12T08:25:47.632Z",
    "dateReserved": "2026-10-09T00:20:06.028Z",
    "dateUpdated": "2026-10-12T11:40:34.088Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-106605 (GCVE-0-2026-106605)

Vulnerability from nvd – Published: 2026-10-12 07:44 – Updated: 2026-10-12 11:40 X_Open Source

Title

WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.22 - Other vulnerability Type vulnerability

Summary

Improper Validation of Specified Quantity in Input vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Input Data Manipulation.This issue affects Flexible Quantity – Measurement Price Calculator for WooCommerce: from n/a through 2.3.22.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-12 11:32 UTC

CWE

CWE-1284 - Improper Validation of Specified Quantity in Input

Assigner

Patchstack CNA under the mitre root

CNA scorecard B 75/100 over 3323 records in the last 180 days details

References

1 reference

URL	Tags
https://patchstack.com/database/wordpress/plugin/…	vdb-entry

Impacted products

1 product

Vendor	Product	Version
WP Desk	Flexible Quantity – Measurement Price Calculator for WooCommerce	Affected: 0 , ≤ 2.3.22 (custom)

Date Public

2026-10-12 07:43

Credits

Peter Tang | Patchstack Bug Bounty Program

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-106605",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-12T11:32:07.255647Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-12T11:40:35.215Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "flexible-quantity-measurement-price-calculator-for-woocommerce",
          "product": "Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce",
          "vendor": "WP Desk",
          "versions": [
            {
              "changes": [
                {
                  "at": "2.3.23",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "2.3.22",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Tang | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-10-12T07:43:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Validation of Specified Quantity in Input vulnerability in WP Desk Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Input Data Manipulation.\u003cp\u003eThis issue affects Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce: from n/a through 2.3.22.\u003c/p\u003e"
            }
          ],
          "value": "Improper Validation of Specified Quantity in Input vulnerability in WP Desk Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Input Data Manipulation.This issue affects Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce: from n/a through 2.3.22."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-153",
          "descriptions": [
            {
              "lang": "en",
              "value": "Input Data Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1284",
              "description": "Improper Validation of Specified Quantity in Input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T07:45:21.300Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/flexible-quantity-measurement-price-calculator-for-woocommerce/vulnerability/wordpress-flexible-quantity-measurement-price-calculator-for-woocommerce-plugin-2-3-22-other-vulnerability-type-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce plugin to the latest available version (at least 2.3.23)."
            }
          ],
          "value": "Update the WordPress Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce plugin to the latest available version (at least 2.3.23)."
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "WordPress Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce plugin \u003c= 2.3.22 - Other vulnerability Type vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-106605",
    "datePublished": "2026-10-12T07:44:09.895Z",
    "dateReserved": "2026-10-07T00:21:31.996Z",
    "dateUpdated": "2026-10-12T11:40:35.215Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-22825 (GCVE-0-2025-22825)

Vulnerability from nvd – Published: 2025-01-21 13:57 – Updated: 2026-04-28 16:11

Title

WordPress Flexible PDF Coupons plugin < 1.10.3 - Stored Cross Site Scripting (XSS) vulnerability

Summary

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdesk Flexible PDF Coupons flexible-coupons allows Stored XSS.This issue affects Flexible PDF Coupons: from n/a through < 1.10.3.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-01-21 14:24 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

Patchstack CNA under the mitre root

CNA scorecard B 75/100 over 3323 records in the last 180 days details

References

1 reference

URL	Tags
https://patchstack.com/database/Wordpress/Plugin/…	vdb-entry

Impacted products

1 product

Vendor	Product	Version
wpdesk	Flexible PDF Coupons	Affected: 0 , ≤ 1.10.3 (custom)

Date Public

2026-04-01 16:32

Credits

savphill | Patchstack Bug Bounty Program

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-22825",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-21T14:24:33.818604Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-12T20:31:26.302Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "flexible-coupons",
          "product": "Flexible PDF Coupons",
          "vendor": "wpdesk",
          "versions": [
            {
              "changes": [
                {
                  "at": "1.10.3",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "1.10.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "savphill | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-04-01T16:32:06.270Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in wpdesk Flexible PDF Coupons flexible-coupons allows Stored XSS.\u003cp\u003eThis issue affects Flexible PDF Coupons: from n/a through \u003c 1.10.3.\u003c/p\u003e"
            }
          ],
          "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in wpdesk Flexible PDF Coupons flexible-coupons allows Stored XSS.This issue affects Flexible PDF Coupons: from n/a through \u003c 1.10.3."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "Stored XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-28T16:11:08.070Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/Wordpress/Plugin/flexible-coupons/vulnerability/wordpress-flexible-pdf-coupons-plugin-1-10-3-stored-cross-site-scripting-xss-vulnerability?_s_id=cve"
        }
      ],
      "title": "WordPress Flexible PDF Coupons plugin \u003c 1.10.3 - Stored Cross Site Scripting (XSS) vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2025-22825",
    "datePublished": "2025-01-21T13:57:36.064Z",
    "dateReserved": "2025-01-07T21:05:54.010Z",
    "dateUpdated": "2026-04-28T16:11:08.070Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-31267 (GCVE-0-2024-31267)

Vulnerability from nvd – Published: 2024-06-09 11:14 – Updated: 2026-04-28 16:09

Title

WordPress Flexible Checkout Fields for WooCommerce plugin <= 4.1.2 - Broken Access Control vulnerability

Summary

Missing Authorization vulnerability in WP Desk Flexible Checkout Fields for WooCommerce.This issue affects Flexible Checkout Fields for WooCommerce: from n/a through 4.1.2.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-06-10 12:34 UTC

CWE

CWE-862 - Missing Authorization

Assigner

Patchstack CNA under the mitre root

CNA scorecard B 75/100 over 3323 records in the last 180 days details

References

1 reference

URL	Tags
https://patchstack.com/database/vulnerability/fle…	vdb-entry

Impacted products

1 product

Vendor	Product	Version
WP Desk	Flexible Checkout Fields for WooCommerce	Affected: n/a , ≤ 4.1.2 (custom)

Credits

Dhabaleshwar Das (Patchstack Alliance)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-31267",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-10T12:34:50.326054Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-10T12:34:57.316Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T01:46:04.894Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_transferred"
            ],
            "url": "https://patchstack.com/database/vulnerability/flexible-checkout-fields/wordpress-flexible-checkout-fields-for-woocommerce-plugin-4-1-2-broken-access-control-vulnerability?_s_id=cve"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "flexible-checkout-fields",
          "product": "Flexible Checkout Fields for WooCommerce",
          "vendor": "WP Desk",
          "versions": [
            {
              "changes": [
                {
                  "at": "4.1.3",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "4.1.2",
              "status": "affected",
              "version": "n/a",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Dhabaleshwar Das (Patchstack Alliance)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in WP Desk Flexible Checkout Fields for WooCommerce.\u003cp\u003eThis issue affects Flexible Checkout Fields for WooCommerce: from n/a through 4.1.2.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in WP Desk Flexible Checkout Fields for WooCommerce.This issue affects Flexible Checkout Fields for WooCommerce: from n/a through 4.1.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-28T16:09:29.806Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/vulnerability/flexible-checkout-fields/wordpress-flexible-checkout-fields-for-woocommerce-plugin-4-1-2-broken-access-control-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to 4.1.3 or a higher version."
            }
          ],
          "value": "Update to 4.1.3 or a higher version."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WordPress Flexible Checkout Fields for WooCommerce plugin \u003c= 4.1.2 - Broken Access Control vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2024-31267",
    "datePublished": "2024-06-09T11:14:37.349Z",
    "dateReserved": "2024-03-29T16:02:17.799Z",
    "dateUpdated": "2026-04-28T16:09:29.806Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-115601 (GCVE-0-2026-115601)

Vulnerability from cvelistv5 – Published: 2026-10-29 14:31 – Updated: 2026-10-30 18:50 X_Open Source

Title

WordPress Custom Price for WooCommerce plugin <= 1.1.29 - Broken Access Control vulnerability

Summary

Missing Authorization vulnerability in WP Desk Custom Price for WooCommerce custom-price-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Price for WooCommerce: from n/a through 1.1.29.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-30 18:39 UTC

CWE

CWE-862 - Missing Authorization

Assigner

Patchstack CNA under the mitre root

CNA scorecard B 75/100 over 3323 records in the last 180 days details

References

1 reference

URL	Tags
https://patchstack.com/database/wordpress/plugin/…	vdb-entry

Impacted products

1 product

Vendor	Product	Version
WP Desk	Custom Price for WooCommerce	Affected: 0 , ≤ 1.1.29 (custom)

Date Public

2026-10-29 14:31

Credits

ssophiz | Patchstack Bug Bounty Program

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-115601",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-30T18:39:42.979095Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-30T18:50:05.850Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "custom-price-for-woocommerce",
          "product": "Custom Price for WooCommerce",
          "vendor": "WP Desk",
          "versions": [
            {
              "changes": [
                {
                  "at": "1.1.30",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "1.1.29",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "ssophiz | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-10-29T14:31:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in WP Desk Custom Price for WooCommerce custom-price-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects Custom Price for WooCommerce: from n/a through 1.1.29.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in WP Desk Custom Price for WooCommerce custom-price-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Price for WooCommerce: from n/a through 1.1.29."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T14:33:00.541Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/custom-price-for-woocommerce/vulnerability/wordpress-custom-price-for-woocommerce-plugin-1-1-29-broken-access-control-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress Custom Price for WooCommerce plugin to the latest available version (at least 1.1.30)."
            }
          ],
          "value": "Update the WordPress Custom Price for WooCommerce plugin to the latest available version (at least 1.1.30)."
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "WordPress Custom Price for WooCommerce plugin \u003c= 1.1.29 - Broken Access Control vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-115601",
    "datePublished": "2026-10-29T14:31:58.839Z",
    "dateReserved": "2026-10-23T00:18:53.712Z",
    "dateUpdated": "2026-10-30T18:50:05.850Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-116856 (GCVE-0-2026-116856)

Vulnerability from cvelistv5 – Published: 2026-10-29 14:24 – Updated: 2026-10-29 16:49 X_Open Source

Title

WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.24 - Broken Access Control vulnerability

Summary

Missing Authorization vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Quantity – Measurement Price Calculator for WooCommerce: from n/a through 2.3.24.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-29 14:34 UTC

CWE

CWE-862 - Missing Authorization

Assigner

Patchstack CNA under the mitre root

CNA scorecard B 75/100 over 3323 records in the last 180 days details

References

1 reference

URL	Tags
https://patchstack.com/database/wordpress/plugin/…	vdb-entry

Impacted products

1 product

Vendor	Product	Version
WP Desk	Flexible Quantity – Measurement Price Calculator for WooCommerce	Affected: 0 , ≤ 2.3.24 (custom)

Date Public

2026-10-29 14:24

Credits

Peter Tang | Patchstack Bug Bounty Program

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-116856",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T14:34:57.861744Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T16:49:19.958Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "flexible-quantity-measurement-price-calculator-for-woocommerce",
          "product": "Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce",
          "vendor": "WP Desk",
          "versions": [
            {
              "changes": [
                {
                  "at": "2.3.25",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "2.3.24",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Tang | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-10-29T14:24:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in WP Desk Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce: from n/a through 2.3.24.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in WP Desk Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce: from n/a through 2.3.24."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T14:24:43.724Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/flexible-quantity-measurement-price-calculator-for-woocommerce/vulnerability/wordpress-flexible-quantity-measurement-price-calculator-for-woocommerce-plugin-2-3-24-broken-access-control-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce plugin to the latest available version (at least 2.3.25)."
            }
          ],
          "value": "Update the WordPress Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce plugin to the latest available version (at least 2.3.25)."
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "WordPress Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce plugin \u003c= 2.3.24 - Broken Access Control vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-116856",
    "datePublished": "2026-10-29T14:24:43.173Z",
    "dateReserved": "2026-10-27T00:20:51.129Z",
    "dateUpdated": "2026-10-29T16:49:19.958Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-114195 (GCVE-0-2026-114195)

Vulnerability from cvelistv5 – Published: 2026-10-22 08:48 – Updated: 2026-10-22 10:56 X_Open Source

Title

WordPress ShopMagic plugin <= 4.9.1 - Sensitive Data Exposure vulnerability

Summary

Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in WP Desk ShopMagic shopmagic-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects ShopMagic: from n/a through 4.9.1.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-22 10:46 UTC

CWE

CWE-538 - Insertion of Sensitive Information into Externally-Accessible File or Directory

Assigner

Patchstack CNA under the mitre root

CNA scorecard B 75/100 over 3323 records in the last 180 days details

References

1 reference

URL	Tags
https://patchstack.com/database/wordpress/plugin/…	vdb-entry

Impacted products

1 product

Vendor	Product	Version
WP Desk	ShopMagic	Affected: 0 , ≤ 4.9.1 (custom)

Date Public

2026-10-22 08:48

Credits

dcs | Patchstack Bug Bounty Program

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-114195",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-22T10:46:03.066910Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-22T10:56:13.370Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "shopmagic-for-woocommerce",
          "product": "ShopMagic",
          "vendor": "WP Desk",
          "versions": [
            {
              "changes": [
                {
                  "at": "4.9.2",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "4.9.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "dcs | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-10-22T08:48:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in WP Desk ShopMagic shopmagic-for-woocommerce allows Retrieve Embedded Sensitive Data.\u003cp\u003eThis issue affects ShopMagic: from n/a through 4.9.1.\u003c/p\u003e"
            }
          ],
          "value": "Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in WP Desk ShopMagic shopmagic-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects ShopMagic: from n/a through 4.9.1."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-37",
          "descriptions": [
            {
              "lang": "en",
              "value": "Retrieve Embedded Sensitive Data"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-538",
              "description": "Insertion of Sensitive Information into Externally-Accessible File or Directory",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T08:49:20.847Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/shopmagic-for-woocommerce/vulnerability/wordpress-shopmagic-plugin-4-9-1-sensitive-data-exposure-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress ShopMagic plugin to the latest available version (at least 4.9.2)."
            }
          ],
          "value": "Update the WordPress ShopMagic plugin to the latest available version (at least 4.9.2)."
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "WordPress ShopMagic plugin \u003c= 4.9.1 - Sensitive Data Exposure vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-114195",
    "datePublished": "2026-10-22T08:48:20.446Z",
    "dateReserved": "2026-10-21T00:23:03.976Z",
    "dateUpdated": "2026-10-22T10:56:13.370Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-110364 (GCVE-0-2026-110364)

Vulnerability from cvelistv5 – Published: 2026-10-15 18:16 – Updated: 2026-10-15 20:39 X_Open Source

Title

WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.23 - Broken Access Control vulnerability

Summary

Missing Authorization vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Quantity – Measurement Price Calculator for WooCommerce: from n/a through 2.3.23.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 20:37 UTC

CWE

CWE-862 - Missing Authorization

Assigner

Patchstack CNA under the mitre root

CNA scorecard B 75/100 over 3323 records in the last 180 days details

References

1 reference

URL	Tags
https://patchstack.com/database/wordpress/plugin/…	vdb-entry

Impacted products

1 product

Vendor	Product	Version
WP Desk	Flexible Quantity – Measurement Price Calculator for WooCommerce	Affected: 0 , ≤ 2.3.23 (custom)

Date Public

2026-10-15 18:16

Credits

myhappyhoon | Patchstack Bug Bounty Program

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-110364",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T20:37:04.225423Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T20:39:16.095Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "flexible-quantity-measurement-price-calculator-for-woocommerce",
          "product": "Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce",
          "vendor": "WP Desk",
          "versions": [
            {
              "changes": [
                {
                  "at": "2.3.24",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "2.3.23",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "myhappyhoon | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-10-15T18:16:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in WP Desk Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce: from n/a through 2.3.23.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in WP Desk Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce: from n/a through 2.3.23."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T18:17:52.800Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/flexible-quantity-measurement-price-calculator-for-woocommerce/vulnerability/wordpress-flexible-quantity-measurement-price-calculator-for-woocommerce-plugin-2-3-23-broken-access-control-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce plugin to the latest available version (at least 2.3.24)."
            }
          ],
          "value": "Update the WordPress Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce plugin to the latest available version (at least 2.3.24)."
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "WordPress Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce plugin \u003c= 2.3.23 - Broken Access Control vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-110364",
    "datePublished": "2026-10-15T18:16:51.303Z",
    "dateReserved": "2026-10-14T00:22:17.448Z",
    "dateUpdated": "2026-10-15T20:39:16.095Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107869 (GCVE-0-2026-107869)

Vulnerability from cvelistv5 – Published: 2026-10-12 08:25 – Updated: 2026-10-12 11:40 X_Open Source

Title

WordPress Flexible Subscriptions plugin <= 1.8.4 - Broken Access Control vulnerability

Summary

Missing Authorization vulnerability in WP Desk Flexible Subscriptions flexible-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Subscriptions: from n/a through 1.8.4.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-12 11:31 UTC

CWE

CWE-862 - Missing Authorization

Assigner

Patchstack CNA under the mitre root

CNA scorecard B 75/100 over 3323 records in the last 180 days details

References

1 reference

URL	Tags
https://patchstack.com/database/wordpress/plugin/…	vdb-entry

Impacted products

1 product

Vendor	Product	Version
WP Desk	Flexible Subscriptions	Affected: 0 , ≤ 1.8.4 (custom)

Date Public

2026-10-12 08:25

Credits

Ivan | Patchstack Bug Bounty Program

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107869",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-12T11:31:13.269475Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-12T11:40:34.088Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "flexible-subscriptions",
          "product": "Flexible Subscriptions",
          "vendor": "WP Desk",
          "versions": [
            {
              "changes": [
                {
                  "at": "1.8.5",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "1.8.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ivan | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-10-12T08:25:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in WP Desk Flexible Subscriptions flexible-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects Flexible Subscriptions: from n/a through 1.8.4.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in WP Desk Flexible Subscriptions flexible-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Subscriptions: from n/a through 1.8.4."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T08:26:50.077Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/flexible-subscriptions/vulnerability/wordpress-flexible-subscriptions-plugin-1-8-4-broken-access-control-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress Flexible Subscriptions plugin to the latest available version (at least 1.8.5)."
            }
          ],
          "value": "Update the WordPress Flexible Subscriptions plugin to the latest available version (at least 1.8.5)."
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "WordPress Flexible Subscriptions plugin \u003c= 1.8.4 - Broken Access Control vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-107869",
    "datePublished": "2026-10-12T08:25:47.632Z",
    "dateReserved": "2026-10-09T00:20:06.028Z",
    "dateUpdated": "2026-10-12T11:40:34.088Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-106605 (GCVE-0-2026-106605)

Vulnerability from cvelistv5 – Published: 2026-10-12 07:44 – Updated: 2026-10-12 11:40 X_Open Source

Title

WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.22 - Other vulnerability Type vulnerability

Summary

Improper Validation of Specified Quantity in Input vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Input Data Manipulation.This issue affects Flexible Quantity – Measurement Price Calculator for WooCommerce: from n/a through 2.3.22.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-12 11:32 UTC

CWE

CWE-1284 - Improper Validation of Specified Quantity in Input

Assigner

Patchstack CNA under the mitre root

CNA scorecard B 75/100 over 3323 records in the last 180 days details

References

1 reference

URL	Tags
https://patchstack.com/database/wordpress/plugin/…	vdb-entry

Impacted products

1 product

Vendor	Product	Version
WP Desk	Flexible Quantity – Measurement Price Calculator for WooCommerce	Affected: 0 , ≤ 2.3.22 (custom)

Date Public

2026-10-12 07:43

Credits

Peter Tang | Patchstack Bug Bounty Program

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-106605",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-12T11:32:07.255647Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-12T11:40:35.215Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "flexible-quantity-measurement-price-calculator-for-woocommerce",
          "product": "Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce",
          "vendor": "WP Desk",
          "versions": [
            {
              "changes": [
                {
                  "at": "2.3.23",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "2.3.22",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Tang | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-10-12T07:43:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Validation of Specified Quantity in Input vulnerability in WP Desk Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Input Data Manipulation.\u003cp\u003eThis issue affects Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce: from n/a through 2.3.22.\u003c/p\u003e"
            }
          ],
          "value": "Improper Validation of Specified Quantity in Input vulnerability in WP Desk Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Input Data Manipulation.This issue affects Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce: from n/a through 2.3.22."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-153",
          "descriptions": [
            {
              "lang": "en",
              "value": "Input Data Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1284",
              "description": "Improper Validation of Specified Quantity in Input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T07:45:21.300Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/flexible-quantity-measurement-price-calculator-for-woocommerce/vulnerability/wordpress-flexible-quantity-measurement-price-calculator-for-woocommerce-plugin-2-3-22-other-vulnerability-type-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce plugin to the latest available version (at least 2.3.23)."
            }
          ],
          "value": "Update the WordPress Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce plugin to the latest available version (at least 2.3.23)."
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "WordPress Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce plugin \u003c= 2.3.22 - Other vulnerability Type vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-106605",
    "datePublished": "2026-10-12T07:44:09.895Z",
    "dateReserved": "2026-10-07T00:21:31.996Z",
    "dateUpdated": "2026-10-12T11:40:35.215Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-22825 (GCVE-0-2025-22825)

Vulnerability from cvelistv5 – Published: 2025-01-21 13:57 – Updated: 2026-04-28 16:11

Title

WordPress Flexible PDF Coupons plugin < 1.10.3 - Stored Cross Site Scripting (XSS) vulnerability

Summary

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdesk Flexible PDF Coupons flexible-coupons allows Stored XSS.This issue affects Flexible PDF Coupons: from n/a through < 1.10.3.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-01-21 14:24 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

Patchstack CNA under the mitre root

CNA scorecard B 75/100 over 3323 records in the last 180 days details

References

1 reference

URL	Tags
https://patchstack.com/database/Wordpress/Plugin/…	vdb-entry

Impacted products

1 product

Vendor	Product	Version
wpdesk	Flexible PDF Coupons	Affected: 0 , ≤ 1.10.3 (custom)

Date Public

2026-04-01 16:32

Credits

savphill | Patchstack Bug Bounty Program

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-22825",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-21T14:24:33.818604Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-12T20:31:26.302Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "flexible-coupons",
          "product": "Flexible PDF Coupons",
          "vendor": "wpdesk",
          "versions": [
            {
              "changes": [
                {
                  "at": "1.10.3",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "1.10.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "savphill | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-04-01T16:32:06.270Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in wpdesk Flexible PDF Coupons flexible-coupons allows Stored XSS.\u003cp\u003eThis issue affects Flexible PDF Coupons: from n/a through \u003c 1.10.3.\u003c/p\u003e"
            }
          ],
          "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in wpdesk Flexible PDF Coupons flexible-coupons allows Stored XSS.This issue affects Flexible PDF Coupons: from n/a through \u003c 1.10.3."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "Stored XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-28T16:11:08.070Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/Wordpress/Plugin/flexible-coupons/vulnerability/wordpress-flexible-pdf-coupons-plugin-1-10-3-stored-cross-site-scripting-xss-vulnerability?_s_id=cve"
        }
      ],
      "title": "WordPress Flexible PDF Coupons plugin \u003c 1.10.3 - Stored Cross Site Scripting (XSS) vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2025-22825",
    "datePublished": "2025-01-21T13:57:36.064Z",
    "dateReserved": "2025-01-07T21:05:54.010Z",
    "dateUpdated": "2026-04-28T16:11:08.070Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-31267 (GCVE-0-2024-31267)

Vulnerability from cvelistv5 – Published: 2024-06-09 11:14 – Updated: 2026-04-28 16:09

Title

WordPress Flexible Checkout Fields for WooCommerce plugin <= 4.1.2 - Broken Access Control vulnerability

Summary

Missing Authorization vulnerability in WP Desk Flexible Checkout Fields for WooCommerce.This issue affects Flexible Checkout Fields for WooCommerce: from n/a through 4.1.2.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-06-10 12:34 UTC

CWE

CWE-862 - Missing Authorization

Assigner

Patchstack CNA under the mitre root

CNA scorecard B 75/100 over 3323 records in the last 180 days details

References

1 reference

URL	Tags
https://patchstack.com/database/vulnerability/fle…	vdb-entry

Impacted products

1 product

Vendor	Product	Version
WP Desk	Flexible Checkout Fields for WooCommerce	Affected: n/a , ≤ 4.1.2 (custom)

Credits

Dhabaleshwar Das (Patchstack Alliance)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-31267",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-10T12:34:50.326054Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-10T12:34:57.316Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T01:46:04.894Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_transferred"
            ],
            "url": "https://patchstack.com/database/vulnerability/flexible-checkout-fields/wordpress-flexible-checkout-fields-for-woocommerce-plugin-4-1-2-broken-access-control-vulnerability?_s_id=cve"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "flexible-checkout-fields",
          "product": "Flexible Checkout Fields for WooCommerce",
          "vendor": "WP Desk",
          "versions": [
            {
              "changes": [
                {
                  "at": "4.1.3",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "4.1.2",
              "status": "affected",
              "version": "n/a",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Dhabaleshwar Das (Patchstack Alliance)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in WP Desk Flexible Checkout Fields for WooCommerce.\u003cp\u003eThis issue affects Flexible Checkout Fields for WooCommerce: from n/a through 4.1.2.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in WP Desk Flexible Checkout Fields for WooCommerce.This issue affects Flexible Checkout Fields for WooCommerce: from n/a through 4.1.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-28T16:09:29.806Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/vulnerability/flexible-checkout-fields/wordpress-flexible-checkout-fields-for-woocommerce-plugin-4-1-2-broken-access-control-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to 4.1.3 or a higher version."
            }
          ],
          "value": "Update to 4.1.3 or a higher version."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WordPress Flexible Checkout Fields for WooCommerce plugin \u003c= 4.1.2 - Broken Access Control vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2024-31267",
    "datePublished": "2024-06-09T11:14:37.349Z",
    "dateReserved": "2024-03-29T16:02:17.799Z",
    "dateUpdated": "2026-04-28T16:09:29.806Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

16 vulnerabilities by WP Desk

CVE-2026-116856 (GCVE-0-2026-116856)

CVE-2026-115601 (GCVE-0-2026-115601)

CVE-2026-114195 (GCVE-0-2026-114195)

CVE-2026-110364 (GCVE-0-2026-110364)

CVE-2026-107869 (GCVE-0-2026-107869)

CVE-2026-106605 (GCVE-0-2026-106605)

CVE-2025-22825 (GCVE-0-2025-22825)

CVE-2024-31267 (GCVE-0-2024-31267)

CVE-2026-115601 (GCVE-0-2026-115601)

CVE-2026-116856 (GCVE-0-2026-116856)

CVE-2026-114195 (GCVE-0-2026-114195)

CVE-2026-110364 (GCVE-0-2026-110364)

CVE-2026-107869 (GCVE-0-2026-107869)

CVE-2026-106605 (GCVE-0-2026-106605)

CVE-2025-22825 (GCVE-0-2025-22825)

CVE-2024-31267 (GCVE-0-2024-31267)