CVE-2026-111404Low· 3.7▾ SunlitConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Leveraging Race Conditions.This issue affects Photo Reviews fo…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Leveraging Race Conditions.This issue affects Photo Reviews for WooCommerce: from n/a through 1.2.31.
woo-photo-reviews <= 1.2.31Update the WordPress Photo Reviews for WooCommerce plugin to the latest available version (at least 1.2.32).
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-100515High· 7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Reflected XSS.This issue affects Photo Reviews for WooCommerce: from …
CVE-2026-100517High· 7.5Unauthenticated Insecure Direct Object References (IDOR) in Photo Reviews for WooCommerce <= 1.2.30 versions.
CVE-2026-112839Medium· 4.3WordPress Customer Coupons for WooCommerce plugin <= 1.3.14 - Broken Access Control vulnerability
CVE-2026-110377Medium· 5.3WordPress Bopo – WooCommerce Product Bundle Builder plugin <= 1.2.3 - Broken Access Control vulnerability
CVE-2026-110376Medium· 4.3WordPress DEPART plugin <= 1.0.10 - Broken Access Control vulnerability
CVE-2026-103081High· 7.5Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Salevo woo-boost-sales allows Code Injection.This issue affects Salevo: from n/a through 1.3.0.