Skip to content
Threat Feed
Subscribe

Tag

E-Commerce

4 briefs RSS
medium advisory

Sylius Mollie Plugin Payment Status Forgery Vulnerability

The Sylius Mollie Plugin is susceptible to an unauthenticated payment status forgery via the webhook handler, allowing attackers to mark arbitrary orders as paid by reusing valid payment IDs.

Sylius Mollie Plugin web-application e-commerce cve-2026-68500 logic-vulnerability
1r 1c
high advisory

CVE-2026-16597 - GTM4WP WordPress Plugin Vulnerable to Stored XSS via WooCommerce Billing Fields

The GTM4WP (Google Tag Manager) plugin for WordPress, in versions up to and including 1.22.3, is vulnerable to stored cross-site scripting (XSS) via CVE-2026-16597, allowing unauthenticated attackers to inject arbitrary web scripts through WooCommerce billing fields during a guest checkout, which execute when a user accesses the compromised page.

GTM4WP +1 wordpress plugin xss web-vulnerability e-commerce
1r 1t 1c
high advisory

CVE-2026-7488 IKAS E-Commerce Sensitive Information Disclosure Vulnerability

A sensitive information insertion vulnerability (CVE-2026-7488) in IKAS Technology Inc. E-Commerce software allows an unauthenticated attacker to retrieve embedded sensitive data by crafting specific requests, leading to potential data exposure.

E-Commerce vulnerability data-exposure cve
1t 1c
high advisory

CVE-2026-14713 — SQL Injection in SourceCodester Pizzafy E-Commerce System

A critical SQL injection vulnerability (CVE-2026-14713) exists in SourceCodester Pizzafy E-Commerce System version 1.0, allowing unauthenticated remote attackers to execute arbitrary SQL commands by manipulating the 'ID' argument in the `/admin/ajax.php?action=confirm_order` endpoint, potentially leading to data exfiltration or modification, with a public exploit available.

Pizzafy E-Commerce System 1.0 sql-injection web-vulnerability cve sourcecodester e-commerce
1r 1t 1c