Unknown Wp Ecommerce vulnerabilities

2 CVEs affecting Unknown Wp Ecommerce, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-1128, published 2026-03-06.

More from Unknown.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-1235, published 2026-02-11. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. The WP eCommerce WordPress plugin through 3.15.1 unserializes user input via ajax actions, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget is present on…
• CVE-2026-1128, published 2026-03-06. Medium severity, CVSS 4.3. EPSS: 0.1% chance of exploitation in the next 30 days. The WP eCommerce WordPress plugin through 3.15.1 does not have CSRF check in place when deleting coupons, which could allow attackers to make a logged in admin remove them via a CSRF attack