Prodigy Commerce Vulnerabilities

The Prodigy Commerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the 'parameters[template_name]' parameter. This makes it possible for unauthenticated attackers to include and read arbitrary files or execute arbitrary files on the server, allowing the execu...

CVSS:

9.8

Affected:

up to 3.3.0

Fixed in:

3.3.1

Disclosed:

Feb 18, 2026

CVE-2026-0926 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Prodigy Commerce Prodigy Commerce allows DOM-Based XSS.This issue affects Prodigy Commerce: from n/a through 3.0.8.

Affected:

up to 3.0.9

Fixed in:

3.0.9

Disclosed:

Dec 13, 2024

CVE-2024-54250 on NVD →

[en] Missing Authorization vulnerability in Prodigy Commerce Prodigy Commerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Prodigy Commerce: from n/a through 3.0.9.

Affected:

up to 3.1.3

Fixed in:

3.1.3

Disclosed:

Dec 9, 2024

CVE-2024-54251 on NVD →

The Prodigy Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.0.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in p...

CVSS:

4.3

Affected:

up to 3.0.8

Fixed in:

3.0.9

Disclosed:

Dec 5, 2024

CVE-2024-54250 on NVD →

The Prodigy Commerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 3.1.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 3.1.2

Fixed in:

3.1.3

Disclosed:

Dec 5, 2024

CVE-2024-54251 on NVD →