| CVE-2026-118407 |
Premium Packages < 7.3.1 - Subscriber+ Guest Order Takeover
|
5.4
Medium
|
Nov 4, 2026 |
| CVE-2026-118403 |
Premium Packages < 7.3.1 - Unauthenticated Guest Order Status Disclosure
|
3.7
Low
|
Nov 4, 2026 |
| CVE-2026-118404 |
Premium Packages < 7.3.1 - Unauthenticated Cross-User Saved Cart Disclosure via IDOR
|
5.3
Medium
|
Nov 4, 2026 |
| CVE-2026-118184 |
The Premium Packages WordPress plugin before 7.2.2 does not prevent unauthenticated visitors from overwriting the…
|
5.3
Medium
|
Oct 31, 2026 |
| CVE-2026-93511 |
The Premium Packages WordPress plugin before 7.2.1 does not verify PayPal's webhook signature before processing payment…
|
5.3
Medium
|
Sep 23, 2026 |
| CVE-2026-19711 |
The Premium Packages WordPress plugin before 7.0.7 does not validate a withdrawal request against the requesting user's…
|
6.5
Medium
|
Aug 16, 2026 |