CVE WatchOct 11, 2026

CVE-2026-103071

Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-yo

CVSS

7.5

High

EPSS

0.3%

p15

KEV

—

Exploit Today

0-100

Published: Oct 10, 2026 · Last modified: Oct 11, 2026 · CWE-94

EPSS · 30d

Not enough EPSS history yet.

Technical description

Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Code Injection.This issue affects Thank You Page Customizer for WooCommerce: from n/a through 1.2.3.

Official references

patchstack.comhttps://patchstack.com/database/wordpress/plugin/woo-thank-you-page-customizer/vulnerability/wordpress-thank-you-page-customizer-for-woocommerce-plugin-1-2-3-content-injection-vulnerability?_s_id=cve

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-1085663.5 LOW

26.4%

——8A vulnerability has been found in InstantSoft icms2 up to 2.18.2. This issue affects the function index of the file templates/default/controllers/messages/index.tpl.php of the component Private Message Handler. Such manipulation of the argument nickname leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 3a1ec8fcb073a46d06a2ab83bc2bf68225834281. It is best practice to apply a patch to resolve this issue.20h CVE-2026-620986.5 MED

9.6%

——3Unauthenticated Content Injection in Boutique <= 2.3.3 versions.17h CVE-2026-4269610.0 CRI

46.6%

——14Unauthenticated Remote Code Execution (RCE) in SiteVault – Backup, Restore, Migration & Cloning <= 1.5.19 versions.17h CVE-2026-398028.1 HIG

38.1%

——11Unauthenticated Remote Code Execution (RCE) in Everest Backup <= 2.3.13 versions.17h CVE-2026-1085989.8 CRI

53.0%

——16Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtime or ProcessBuilder, executing OS commands in the Floci JVM.1d CVE-2026-1085936.4 MED

17.4%

——59router 0.4.1 through 0.5.99 contains a configuration injection vulnerability in the POST /api/cli-tools/hermes-settings endpoint that allows authenticated dashboard users to inject arbitrary keys into the Hermes Agent config.yaml file. Attackers can submit a baseUrl containing double quotes and newlines to add hooks_auto_accept and a hooks.post_llm_call shell command, which Hermes Agent executes without approval after an LLM call.1d