Tech LeverageSunday, October 11, 2026

Multiple WordPress Plugins Disclosed With XSS, Authorization, and File Inclusion Flaws

Sourced from 2 publications

•CoreShop through 1.5.5 has an authorization bypass allowing authenticated users to act on other customers' orders via the OrderController.
•MultiVendorX through 5.0.19 permits vendor accounts to modify marketplace-wide settings through an improperly secured REST endpoint.
•Elated-mes Ambient Plugin up to 1.7 contains a critical file inclusion vulnerability rated more severe than the XSS flaws.
•At least seven plugins carry remotely exploitable XSS vulnerabilities, including four kutethemes products, designthemes LMS, Educavo, and Barcode Scanner.
•No known exploits are currently available for any of the disclosed vulnerabilities.

Sources

CVE-2026-108696 CoreShop through 1.5.5 Authorization Bypass via OrderController...

Vulners

CVE-2026-108695 MultiVendorX through 5.0.19 Incorrect Authorization via Settings...

Vulners

CVE-2026-66563 | meREX Windsor Plugin up to 2.10 on WordPress deserialization

Vuldb

CVE-2026-78532 | designthemes LMS Plugin up to 8.3 on WordPress cross site scrip...

Vuldb

CVE-2026-78534 | Keen IT Solutions Educavo Plugin up to 3.4.2 on WordPress cross...

Vuldb

CVE-2026-62116 | Barcode Scanner With Inventory and Order Manager Plugin cross s...

Vuldb

CVE-2026-62100 | Kutemes KuteShop Plugin up to 4.2.9 on WordPress cross site scr...

Vuldb

CVE-2026-62095 | kutethemes Biolife Plugin up to 3.2.3 on WordPress cross site s...

Vuldb

CVE-2026-62091 | Kutethemes Armania Plugin up to 1.4.8 on WordPress cross site s...

Vuldb

CVE-2026-62093 | kutethemes TechOne Plugin up to 3.0.3 on WordPress cross site s...

Vuldb

Was this story useful?

Curated from 2 sources. Every summary is reviewed for accuracy, but may still contain errors. We always link to original sources for verification.