Vulnerabilities

TI-2026-30996 CVE-2026-42773 · GHSA-5ffv-prf8-5rc6

WordPress eMagicOne Store Manager plugin <= 1.3.2 - SQL Injection vulnerability

MEDIUM 46

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in eMagicOne eMagicOne Store Manager allows Blind SQL Injection.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00372 Published 2026-05-25 No fix listed CWE-89

TI-2025-04534 CVE-2025-5058 · GHSA-3m2v-5hxx-gq9h

eMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Upload via set_image()

MEDIUM 52

The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_image() function in all versions up to, and including, 1.2.5.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01484 Published 2025-05-24 No fix listed CWE-434

TI-2025-03865 CVE-2025-4336 · GHSA-97qx-x85w-q75v

eMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Upload via set_file()

MEDIUM 45

The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_file() function in all versions up to, and including, 1.2.5.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01439 Published 2025-05-24 No fix listed CWE-434

TI-2025-04116 CVE-2025-4603 · GHSA-88gp-9664-52xh

eMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Deletion

MEDIUM 42

The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_file() function in all versions up to, and including, 1.2.5…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01517 Published 2025-05-24 No fix listed CWE-73

TI-2025-04115 CVE-2025-4602 · GHSA-wrr5-5xv5-q9rx

eMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Read

LOW 34

The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Reads in all versions up to, and including, 1.2.5 via the get_file() function.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00727 Published 2025-05-24 No fix listed CWE-73