PT-2026-55513 · WordPress · Curcy – Multi Currency For Woocommerce

Sterva

·

CVE-2026-11778

·

Published

2026-07-03

·

Updated

2026-07-06

CVSS v3.1

5.4

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions The CURCY – Multi Currency for WooCommerce – Smoothly on WooCommerce 9.x versions prior to 2.2.15
Description Unauthenticated attackers can execute arbitrary shortcodes because the software fails to properly validate a value before running the do shortcode() function. This issue occurs via the exchange parameter.
Recommendations Update the plugin to a version later than 2.2.14.

Fix

Code Injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-11778

Affected Products

Curcy – Multi Currency For Woocommerce