Skip to content
OpenAdvisories

Vendor

eoxia

5 known vulnerabilities.

Products

WPshop 2 – E-Commerce 3 Task Manager 2
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-4004

    Task Manager <= 3.0.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'task_id' Parameter

    The Task Manager plugin for WordPress is vulnerable to arbitrary shortcode execution via the 'search' AJAX action in all versions up to, and including, 3.0.2. This is due to missing capability checks in the callback_search() function and insufficient input va…

    eoxia Task Manager Web / CMS
  • Medium 6.5
    CVE-2026-2351

    Task Manager <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Read

    The Task Manager plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.0.2 via the callback_get_text_from_url() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, t…

    eoxia Task Manager Web / CMS
  • Medium 6.5
    CVE-2025-3853

    WPshop 2 – E-Commerce 2.0.0 - 2.6.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Key Generation

    The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 2.0.0 to 2.6.0 via the callback_generate_api_key() due to missing validation on a user controlled key. This makes it possible for authenticated attack…

    eoxia WPshop 2 – E-Commerce Web / CMS