Unknown VERGE3D Publishing And E-Commerce vulnerabilities

3 CVEs affecting Unknown VERGE3D Publishing And E-Commerce, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-92994, published 2026-09-30.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-92994, published 2026-09-30. High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days. The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded through its file storage feature and serves them back with an attacker-controlled…
CVE-2026-92995, published 2026-09-27. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. The Verge3D Publishing and E-Commerce WordPress plugin through 4.13.0 does not restrict access to a file-download handler, allowing unauthenticated users to download the digital-goods files attached…
CVE-2026-92996, published 2026-09-28. Medium severity, CVSS 5.3. EPSS: 0.1% chance of exploitation in the next 30 days. The Verge3D WordPress plugin from 4.1.0 through 4.13.0 does not verify with the payment provider that a payment was actually made, and does not check order ownership, allowing unauthenticated users…