SellKit CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

Review SellKit CVE published 2026-10-14

CVE-2026-94254

The SellKit WordPress plugin before 2.8.0 does not validate client-supplied product prices during checkout, allowing unauthenticated attackers to set arbitrary prices for any purchasable product. This vulnerability affects WordPress installations using the SellKit plugin, specifically versions 2.3.5 through 2.7.0. Defenders should assess exposure, prioritize verification, and remediate vulnerable instance [truncated]