Grid/List View for WooCommerce <= 3.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'position' Shortcode Attribute
medium
The Grid/List View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'position' Shortcode Attribute in all versions up to, and including, 3.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level acces...
- CVSS:
- 6.4
- Affected:
- up to 3.0.9
- Fixed in:
- 3.0.9.1
- Disclosed:
- Jul 22, 2026
CVE-2026-15794 on NVD →
BeRocket Plugins <= (Various Versions) - Missing Authorization
medium
Several BeRocket Plugins for WordPress are vulnerable to authorization bypass due to missing capability checks on functions corresponding to AJAX actions that are available to subscribers. This includes the close_notice, subscribe, disable_rate_notice, feature_request_send, get_plugin_error_ajax, close_notice, and test...
- CVSS:
- 5.4
- Affected:
- up to 1.1.3.6
- Fixed in:
- 1.1.3.7
- Disclosed:
- Dec 13, 2022
CVE-2022-45813 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database