CVE-2026-73181

HighCVSS 7.5/10Last modified Oct 23, 2026

Description

Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce < 7.6 versions.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Aug 18, 2026
Last modified
Oct 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-731827.1Unauthenticated Cross Site Scripting (XSS) in BBQ Pro <= 3.9 versions.CVE-2026-731839.3Unauthenticated SQL Injection in Maps Marker Pro <= 4.32 versions.CVE-2026-731847.1Unauthenticated Cross Site Scripting (XSS) in Global Gallery <= 11.1.2 versions.CVE-2026-731859.3Unauthenticated SQL Injection in NGG Smart Image Search < 4.0.0 versions.CVE-2026-731879.3Unauthenticated SQL Injection in Sticky Chat Widget <= 1.4.2 versions.CVE-2026-73197.3A flaw has been found in elinsky execution-system-mcp 0.1.0. The impacted element is the function _get_context_file_path of the file src/exeCVE-2026-731907.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in W3 Eden WPDM – Premium Packages wpdm-pCVE-2026-731916.1URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Syncope. When the Syncope SRA is configured for CAS authentCVE-2026-731926.1An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability when using the XSSAPI.getValiCVE-2026-731939.8DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparound in the output buffer size compuCVE-2026-731949.1DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in pCVE-2026-731957.3Improper Encoding or Escaping of Output vulnerability in Apache Syncope. Authenticated users can store a spreadsheet formula payload in o
CVE-2026-73181: High severity, CVSS 7.5 | Vulnix