CVE WatchOct 29, 2026

CVE-2026-114173

The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthen

CVSS

5.3

Medium

EPSS

—

KEV

—

Exploit Today

0-100

Published: Oct 29, 2026 · Last modified: Oct 29, 2026 · CWE-201

EPSS · 30d

Not enough EPSS history yet.

Technical description

The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat actor could read product passwords and private product metadata from an affected store.

Official references

trust.canva.comhttps://trust.canva.com?tcuUid=acddc58b-886d-487c-b2d4-837fde87ddc8

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-482005.3 MED

—

———Insertion of Sensitive Information Into Sent Data vulnerability in Barn2 Plugins Document Library Lite document-library-lite allows Retrieve Embedded Sensitive Data.This issue affects Document Library Lite: from n/a through 1.3.0.4h CVE-2026-1180837.5 HIG

—

———Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions.4h CVE-2026-1155917.5 HIG

—

——0Insertion of Sensitive Information Into Sent Data vulnerability in Supsystic Contact Form by Supsystic contact-form-by-supsystic allows Retrieve Embedded Sensitive Data.This issue affects Contact Form by Supsystic: from n/a through 1.10.5.6h CVE-2026-1166895.9 MED

18.7%

——6follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. This issue is fixed in version 1.16.2.1d CVE-2026-1155946.5 MED

24.5%

——7Insertion of Sensitive Information Into Sent Data vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Retrieve Embedded Sensitive Data.This issue affects Media LIbrary Assistant: from n/a through 3.42.3d CVE-2026-1141905.9 MED

23.4%

——7Insertion of Sensitive Information Into Sent Data vulnerability in Hai Zheng / Lite Speed Cache LiteSpeed Cache litespeed-cache allows Retrieve Embedded Sensitive Data.This issue affects LiteSpeed Cache: from n/a through 7.9.3d