Vulnerabilities

TI-2026-14417 CVE-2026-17581 · GHSA-fq4g-jqvq-wx5r

WCPOS <= 1.9.14 - Authenticated (Shop Manager+) Code Injection via 'thermal' Template Engine

LOW 36

The WCPOS – Point of Sale (POS) plugin for WooCommerce plugin for WordPress is vulnerable to Code Injection via the 'thermal' Template Engine in all versions up to, and including, 1.9.14 due to the Receipt_Renderer_Facto…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0137 Published 2026-08-16 No fix listed CWE-94

TI-2026-13457 CVE-2026-16078 · GHSA-4h8p-8qhg-5wv2

WCPOS <= 1.9.8 - Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read via 'type' Parameter

LOW 31

The WCPOS – Point of Sale (POS) plugin for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.9.8 via the 'type' parameter parameter.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00911 Published 2026-07-23 No fix listed CWE-22

TI-2026-37833 CVE-2026-52711 · GHSA-6g34-fq4g-j6p6

WordPress WooCommerce POS plugin <= 1.8.14 - Broken Access Control vulnerability

LOW 38

Unauthenticated Broken Access Control in WooCommerce POS <= 1.8.14 versions.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00225 Published 2026-06-16 No fix listed CWE-862

TI-2026-33119 CVE-2026-45321 · GHSA-g7cv-rxg3-hmpx

Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

CRITICAL 100KEV

On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.03278 Published 2026-05-12 Fixed in 1.166.16, 1.161.13 +26 CWE-506

TI-2025-30487 CVE-2025-48117 · GHSA-q9j8-hx2p-36g7

WordPress WooCommerce POS plugin <= 1.7.8 - Broken Access Control Vulnerability

LOW 30

Missing Authorization vulnerability in kilbot WooCommerce POS woocommerce-pos allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce POS: from n/a through <= 1.7.8.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00292 Published 2025-05-16 No fix listed CWE-862

TI-2024-02215 CVE-2024-2384 · GHSA-28f4-f5wq-36wr

Insufficient verification of data authenticity in kilbot WCPOS – Point of Sale plugin for…

LOW 20

The WooCommerce POS plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 1.4.11.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0027 Published 2024-03-20 No fix listed CWE-345