vendidero vulnerabilities

Products

• Germanized for WooCommerce 2
• Shiptastic for WooCommerce 1
• Trusted Shops Easy Integration for WooCommerce 1

Latest vendidero CVEs

Newest publication first

1. CVE-2026-109231 Germanized for WooCommerce <= 4.1.4 - Authenticated (Subscriber+) Unauthorized Access of Private Data via Activation Token Reuse via Activation Token Reuse After Email Change

   Published 2026-10-31

   Medium·CVSS 4.3 EPSS 0.37%

   The Germanized for WooCommerce plugin for WordPress is vulnerable to Unauthorized Access of Private Data via Activation Token Reuse in versions up to, and including, 4.1.4. This is due to the on_user_email_changed hook — which is responsible for rotating the activation token and...

2. CVE-2026-96816 WordPress Trusted Shops Easy Integration for WooCommerce plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerability

   Published 2026-09-30

   High·CVSS 7.1 EPSS 0.18%

   Unauthenticated Cross Site Scripting (XSS) in Trusted Shops Easy Integration for WooCommerce <= 2.0.6 versions.

3. CVE-2026-65501 WordPress Shiptastic for WooCommerce plugin <= 5.1.0 - Insecure Direct Object References (IDOR) vulnerability

   Published 2026-07-23

   Medium·CVSS 5.3 EPSS 0.31%

   Unauthenticated Insecure Direct Object References (IDOR) in Shiptastic for WooCommerce <= 5.1.0 versions.

4. CVE-2026-2582 Germanized for WooCommerce <= 3.20.5 - Unauthenticated Arbitrary Shortcode Execution

   Published 2026-04-14

   Medium·CVSS 6.5 EPSS 0.43%

   The The Germanized for WooCommerce plugin for WordPress is vulnerable to arbitrary shortcode execution via 'account_holder' parameter in all versions up to, and including, 3.20.5. This is due to the software allowing users to execute an action that does not properly validate a va...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.