search
WooCommerce
Trends
- 1WPC Product Options plugin hit by stored XSS flawโผ๐จ EUVD-2026-91952 ๐ Score: 7.2/10 (CVSS v3.1) ๐ฆ Product: WPC Product Options for WooCommerce ๐ข Vendor: WPClever ๐ Update
A stored cross-site scripting vulnerability, tracked as EUVD-2026-91952 and rated 7.2 out of 10 on the CVSS v3.1 scale, has been disclosed in the WPC Product Options for WooCommerce WordPress plugin from vendor WPClever. The flaw involves injection through wpcpo-* array keys submitted via multipart requests, meaning attackers could persist malicious scripts on product pages and target site visitors or administrators. The advisory record was updated on 3 October 2026.
- 2Avada WordPress theme hit by reflected XSS vulnerabilityโ๐จ EUVD-2026-91174 ๐ Score: 6.1/10 (CVSS v3.1) ๐ฆ Product: Avada | Website Builder For WordPress & WooCommerce ๐ข Vendor: T
A medium-severity vulnerability, tracked as EUVD-2026-91174 with a CVSS score of 6.1, has been reported in Avada, the popular website builder theme for WordPress and WooCommerce from vendor ThemeFusion. The flaw is a reflected cross-site scripting issue, updated on 2026-10-02, allowing attackers to inject malicious scripts via crafted links. WordPress site owners using Avada are advised to update promptly.