Vulnerabilities

TI-2026-68008 CVE-2026-42635 · GHSA-83f5-wfww-wh77

Cross-site scripting in WooCommerce Simple Auctions plugin

LOW 31

Unauthenticated Cross Site Scripting (XSS) in WooCommerce Simple Auctions <= 3.0.10 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.0023 Published 2026-10-06 No fix listed CWE-79

TI-2026-67928 CVE-2026-32580 · GHSA-v9m3-84fg-728v

SQL injection in WooCommerce Lottery WordPress plugin

LOW 33

Unauthenticated SQL Injection in WooCommerce Lottery <= 2.2.9 versions.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00297 Published 2026-10-06 No fix listed CWE-89

TI-2026-15446 CVE-2026-18884 · GHSA-6795-cv2m-637x

WooCommerce Lottery <= 2.2.9 - Unauthenticated Time-Based SQL Injection via 'orderby' and 'order' Parameters

MEDIUM 40

The WooCommerce Lottery plugin for WordPress is vulnerable to Time-Based SQL Injection via 'orderby' and 'order' GET Parameters in all versions up to, and including, 2.2.9 due to insufficient escaping on the user supplie…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00541 Published 2026-08-26 No fix listed CWE-89

Vulnerabilities

Filters

Cross-site scripting in WooCommerce Simple Auctions plugin

SQL injection in WooCommerce Lottery WordPress plugin

WooCommerce Lottery <= 2.2.9 - Unauthenticated Time-Based SQL Injection via 'orderby' and 'order' Parameters