CVE WatchJul 23, 2026

CVE-2026-61945

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in MultiVendorX WooCommerce Product Stock Alert all

CVSS

6.5

Medium

EPSS

0.4%

p31

KEV

—

Exploit Today

0-100

Published: Jul 23, 2026 · Last modified: Jul 23, 2026 · CWE-497

EPSS · 30d

0.2%EPSS · 30 days0.4%

2026-08-222026-09-19

Technical description

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in MultiVendorX WooCommerce Product Stock Alert allows Retrieve Embedded Sensitive Data. This issue affects WooCommerce Product Stock Alert: from n/a through 3.0.6.

Official references

patchstack.comhttps://patchstack.com/database/wordpress/plugin/woocommerce-product-stock-alert/vulnerability/wordpress-woocommerce-product-stock-alert-plugin-3-0-6-sensitive-data-exposure-vulnerability?_s_id=cve

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2025-331416.5 MED

31.6%

——9IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 006 could allow an authenticated user to obtain sensitive information from backup files due to incorrect permissions assignment.1d CVE-2026-275536.5 MED

44.1%

——13A low-privileged remote attacker can manipulate the schema path parameter in the /index.php/diagnostics_tab/ajax_diag_table_rows endpoint using a valid user cookie allowing disclosure of all user password hashes.23h CVE-2026-380588.1 HIG

27.3%

——8The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contains MD5-crypt password hashes for the root SSH and web administration accounts. Any user with valid web credentials can extract these hashes and crack them offline using commodity hardware.1d CVE-2026-619114.3 MED

12.5%

——4An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script that probed whether another user's private mailbox existed, or read the value of shared mailbox annotations, by observing which fileinto branch fired during LMTP delivery.3d CVE-2026-813945.5 MED

33.3%

——10Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.2d CVE-2026-813875.5 MED

35.0%

——11Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.2d