CVE-2026-97071

MediumCVSS 5.3/10Last modified Oct 6, 2026

Description

Incorrect Calculation vulnerability in VillaTheme CURCY woo-multi-currency allows Integer Attacks.This issue affects CURCY: from n/a through 2.2.17.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-682

Affected software

No affected versions have been published.

Timeline

Published
Oct 5, 2026
Last modified
Oct 6, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-970744.3Subscriber Insecure Direct Object References (IDOR) in Newsletters, Email Marketing, SMS and Popups by Omnisend <= 1.9.0 versions.CVE-2026-970756.5Missing Authorization vulnerability in WP Media WP Rocket wp-rocket allows Exploiting Incorrectly Configured Access Control Security Levels.CVE-2026-970767.5Executable Regular Expression Error vulnerability in WP Media WP Rocket wp-rocket allows Code Injection.This issue affects WP Rocket: from nCVE-2026-970777.1Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.18 versions.CVE-2026-970785.3Unauthenticated Insecure Direct Object References (IDOR) in Client Invoicing by Sprout Invoices <= 20.8.17 versions.CVE-2026-970794.3Subscriber Insecure Direct Object References (IDOR) in Webba Booking <= 6.5.0 versions.CVE-2026-97084.9Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to validate that an assigned incoming webhook user has acceCVE-2026-97097.7The Cornerstone WordPress plugin before 7.8.9 does not enforce capability checks on one of its REST API routes, allowing any authenticated uCVE-2026-97107.7The Cornerstone WordPress plugin before 7.8.8 does not enforce capability checks on one of its CSS-preview request handlers, and exposes theCVE-2026-97119.8The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress (full) is vulnerable to SQL Injection via the WordPress 'search' CVE-2026-97123.8When creating an export through the pretix API, API clients are returned an UUID value for their export job (a long, random string like 35CVE-2026-97137.5The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' and 'table' parameters in the u
CVE-2026-97071: Medium severity, CVSS 5.3 | Vulnix