Unknown Wc Vendors vulnerabilities

3 CVEs affecting Unknown Wc Vendors, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-81428, published 2026-09-02.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-81428, published 2026-09-02. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when saving product variations, allowing authenticated users with the vendor role to…
CVE-2026-81427, published 2026-09-02. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to…
CVE-2026-81426, published 2026-09-02. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logged-in vendor change the…