UNKNOWN NVD

CVE-2026-19088

The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an

The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout are stored under and readable by the attacker.

References

https://wpscan.com/vulnerability/f58066e9-8066-43bc-8778-7ded279e8ee2/

Published: 2026-08-13 · Source: NVD · Feed updated: 2026-08-13

This unknown severity vulnerability was published on 2026-08-13 via NVD.

vulnfeed aggregates 10489 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.