https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 18:31:24 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-382517 EUVD-2026-382517 https://cve.radiocsirt.org/vuln/euvd-2026-382517 https://cve.radiocsirt.org/vuln/fkie_cve-2026-100149 <p>The WPZOOM Connect: AI Chat, Click to Chat, Social Icons &amp; Share Buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.7.3 via the &#39;x-yamidoo-signature (attacker-obtained via inline_js identify payload)&#39; parameter. This makes it possible for unauthenticated attackers to extract the full customer card — including name, WordPress user ID, order history, order totals, purchased products, payment method labels, and EDD Software Licensing license keys with status and activation counts — for any arbitrary victim email address on the site. Exploitation requires the attacker to register a WooCommerce customer or subscriber-level account with a crafted email address whose local part encodes the target timestamp and victim email, allowing the signature printed into the page HTML by inline_js() to pass verify_request() for an arbitrary victim; both the share_customer_data and identify_logged_in settings are enabled by default, so no non-default configuration is required.</p> <p>The WPZOOM Connect: AI Chat, Click to Chat, Social Icons &amp; Share Buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.7.3 via the &#39;x-yamidoo-signature (attacker-obtained via inline_js identify payload)&#39; parameter. This makes it possible for unauthenticated attackers to extract the full customer card — including name, WordPress user ID, order history, order totals, purchased products, payment method labels, and EDD Software Licensing license keys with status and activation counts — for any arbitrary victim email address on the site. Exploitation requires the attacker to register a WooCommerce customer or subscriber-level account with a crafted email address whose local part encodes the target timestamp and victim email, allowing the signature printed into the page HTML by inline_js() to pass verify_request() for an arbitrary victim; both the share_customer_data and identify_logged_in settings are enabled by default, so no non-default configuration is required.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-100149 https://cve.radiocsirt.org/vuln/ghsa-rhmj-6pg3-6h84 <p>The WPZOOM Connect: AI Chat, Click to Chat, Social Icons &amp; Share Buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.7.3 via the &#39;x-yamidoo-signature (attacker-obtained via inline_js identify payload)&#39; parameter. This makes it possible for unauthenticated attackers to extract the full customer card — including name, WordPress user ID, order history, order totals, purchased products, payment method labels, and EDD Software Licensing license keys with status and activation counts — for any arbitrary victim email address on the site. Exploitation requires the attacker to register a WooCommerce customer or subscriber-level account with a crafted email address whose local part encodes the target timestamp and victim email, allowing the signature printed into the page HTML by inline_js() to pass verify_request() for an arbitrary victim; both the share_customer_data and identify_logged_in settings are enabled by default, so no non-default configuration is required.</p> <p>The WPZOOM Connect: AI Chat, Click to Chat, Social Icons &amp; Share Buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.7.3 via the &#39;x-yamidoo-signature (attacker-obtained via inline_js identify payload)&#39; parameter. This makes it possible for unauthenticated attackers to extract the full customer card — including name, WordPress user ID, order history, order totals, purchased products, payment method labels, and EDD Software Licensing license keys with status and activation counts — for any arbitrary victim email address on the site. Exploitation requires the attacker to register a WooCommerce customer or subscriber-level account with a crafted email address whose local part encodes the target timestamp and victim email, allowing the signature printed into the page HTML by inline_js() to pass verify_request() for an arbitrary victim; both the share_customer_data and identify_logged_in settings are enabled by default, so no non-default configuration is required.</p> https://cve.radiocsirt.org/vuln/ghsa-rhmj-6pg3-6h84