Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: WholesaleX 3.0.9 Clear all filters
TI-2026-78637 CVE-2026-111956 · GHSA-f9pm-pfcr-fr64

Sensitive user import file exposed in WholesaleX WordPress plugin

Priority LOW 26

The WholesaleX WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly accessible location under a predictable name, allowing unauthenticated users to download the most recent…

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00309 Published 2026-10-21 Fixed in 3.0.9 CWE-200
TI-2026-78636 CVE-2026-111955 · GHSA-xm5m-h552-37c3

Improper authentication in WholesaleX lets attackers bypass account approval

Priority LOW 34

The WholesaleX WordPress plugin before 3.0.9 does not check that a stored account confirmation code is set before comparing it with the one supplied in a request, allowing unauthenticated users to activate pending accoun…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00243 Published 2026-10-21 Fixed in 3.0.9 CWE-287