| CVE-2026-97219 |
The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing…
|
4.3
Medium
|
Oct 2, 2026 |
| CVE-2026-18234 |
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling…
|
6.5
Medium
|
Aug 29, 2026 |
| CVE-2026-18233 |
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery…
|
6.5
Medium
|
Aug 29, 2026 |
| CVE-2026-16030 |
The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used…
|
8.1
High
|
Aug 7, 2026 |
| CVE-2026-16038 |
The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an…
|
9.1
Critical
|
Aug 7, 2026 |
| CVE-2026-16039 |
The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own…
|
6.5
Medium
|
Aug 7, 2026 |
| CVE-2026-16041 |
The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST…
|
7.5
High
|
Aug 7, 2026 |
| CVE-2023-3131 |
The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege…
|
Not rated
|
Jul 10, 2023 |
| CVE-2023-3209 |
The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege…
|
Not rated
|
Jul 10, 2023 |
| CVE-2023-3077 |
The MStore API WordPress plugin before 3.9.8 does not sanitise and escape a parameter before using it in a SQL…
|
Not rated
|
Jul 10, 2023 |
| CVE-2023-3076 |
The MStore API WordPress plugin before 3.9.9 does not prevent visitors from creating user accounts with the role of…
|
Not rated
|
Jul 10, 2023 |
| CVE-2021-24148 |
A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign…
|
Not rated
|
Mar 18, 2021 |