CVE-2026-2019

The Cart All In One For WooCommerce plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.1.21. This is due to insufficient input validation on the 'Assign page' field which is passed directly to the eval() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute arbitrary PHP code on the server.

• CWE-74

• https://plugins.trac.wordpress.org/browser/woo-cart-all-in-one/tags/1.1.21/includes/frontend/sidebar-cart-icon.php#L245
• https://plugins.trac.wordpress.org/browser/woo-cart-all-in-one/trunk/includes/frontend/sidebar-cart-icon.php#L245
• https://plugins.trac.wordpress.org/changeset/3455202/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/25bdb89f-3478-4a1a-8bf0-46e88207eb21?source=cve

Published

Feb 18, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-20184A vulnerability in the integration of single sign-on (SSO) w…9.8
• CVE-2026-20185A vulnerability in the Simple Network Management Protocol (S…7.7
• CVE-2026-20186A vulnerability in Cisco Identity Services Engine (ISE) coul…9.9
• CVE-2026-20187As part of Cisco's ongoing commitment to proactive security …7.5
• CVE-2026-20188Following the initial publication of the Security Advisory a…0
• CVE-2026-20189A vulnerability in the log file download functionality of Ci…4.3
• CVE-2026-20190A vulnerability in Cisco ISE and ISE-PIC could allow an unau…7.5
• CVE-2026-20191A vulnerability in Cisco Catalyst Center could allow an unau…7.5
• CVE-2026-20193A vulnerability in the RADIUS Policy API endpoints of Cisco …4.3
• CVE-2026-20195A vulnerability in an identity management API endpoint of Ci…5.3
• CVE-2026-20198A vulnerability in the web-based management interface of Cis…4.8
• CVE-2026-20199A vulnerability in the SSL certificate handling of Cisco Tho…7.2