prodigycommerce vulnerabilities

Products

• Prodigy Commerce 3

Latest prodigycommerce CVEs

Newest publication first

1. CVE-2026-0926 Prodigy Commerce <= 3.3.0 - Unauthenticated Local File Inclusion via parameters[template_name]

   Published 2026-02-19

   Critical·CVSS 9.8 EPSS 9.3%

   The Prodigy Commerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the 'parameters[template_name]' parameter. This makes it possible for unauthenticated attackers to include and read arbitrary files or execute arbitrary...

2. CVE-2024-54250 WordPress Prodigy Commerce plugin <= 3.0.8 - Cross Site Scripting (XSS) vulnerability

   Published 2024-12-13

   Medium·CVSS 6.5

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in prodigycommerce Prodigy Commerce prodigy-commerce allows DOM-Based XSS.This issue affects Prodigy Commerce: from n/a through <= 3.0.8.

3. CVE-2024-54251 WordPress Prodigy Commerce plugin <= 3.1.2 - Broken Access Control vulnerability

   Published 2024-12-09

   Medium·CVSS 6.5

   Missing Authorization vulnerability in prodigycommerce Prodigy Commerce prodigy-commerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Prodigy Commerce: from n/a through <= 3.1.2.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.