Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Ni WooCommerce Sales Report 4.2.0 Clear all filters
TI-2026-54563 CVE-2026-78474 · GHSA-4p9c-cw99-phxx

Ni WooCommerce Sales Report < 4.2.0 - Unauthenticated Order and Customer Data Disclosure via 'btn_print' Parameter

Priority LOW 30

The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not have any authentication or authorisation checks on one of its report-printing routines, allowing unauthenticated users to retrieve WooCommerce order…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00394 Published 2026-09-16 Fixed in 4.2.0 CWE-200
TI-2026-54562 CVE-2026-78472 · GHSA-32fm-vvf7-rmhw

Ni WooCommerce Sales Report < 4.2.0 - Unauthenticated SQLi via 'sort' Parameter

Priority MEDIUM 44

The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00445 Published 2026-09-16 Fixed in 4.2.0 CWE-89