Plugin icon

Subscriptions for WooCommerce

subscriptions-for-woocommerce

Vulnerabilities:

10

Last Updated:

September 9, 2026

Active Installs:

10000

Published
Title
Fixed in
CVSS
Published
2026-09-14
Title
Subscriptions for WooCommerce < 2.0.3 - Subscription Cancellation via CSRF
Fixed in
Fixed in 2.0.3
CVSS
4.3 (medium)
Published
2026-09-14
Title
Subscriptions for WooCommerce < 2.0.3 - Unauthenticated Subscription Data Disclosure via REST API Secret Key Bypass
Fixed in
Fixed in 2.0.3
CVSS
5.3 (medium)
Published
2026-08-03
Title
Subscriptions for WooCommerce < 2.0.1 - Shop Manager+ Arbitrary Plugin Installation
Fixed in
Fixed in 2.0.1
CVSS
7.2 (high)
Published
2026-08-03
Title
Subscriptions for WooCommerce < 2.0.1 - Payment Bypass via Attacker-Supplied PayPal Capture Token
Fixed in
Fixed in 2.0.1
CVSS
5.9 (medium)
Published
2026-08-03
Title
Subscriptions for WooCommerce < 2.0.1 - Subscriber+ Subscription Detail Disclosure via IDOR
Fixed in
Fixed in 2.0.1
CVSS
4.3 (medium)
Published
2026-07-31
Title
Subscriptions for WooCommerce < 2.0.1 - Authenticated (Contributor+) Privilege Escalation via '_wps_plan_user_role' Membership Plan Meta
Fixed in
Fixed in 2.0.1
CVSS
7.2 (high)
Published
2026-07-29
Title
Subscriptions for WooCommerce < 2.0.1 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation via wps_sfw_install_plugin_configuration AJAX Action
Fixed in
Fixed in 2.0.1
CVSS
7.2 (high)
Published
2026-06-25
Title
Subscriptions for WooCommerce < 1.9.6 - Missing Authorization
Fixed in
Fixed in 1.9.6
CVSS
5.3 (medium)
Published
2026-03-17
Title
Subscriptions for WooCommerce < 1.9.3 - Missing Authorization to Unauthenticated Arbitrary Subscription Cancellation
Fixed in
Fixed in 1.9.3
CVSS
5.3 (medium)
Published
2026-03-13
Title
Subscriptions for WooCommerce < 1.9.0 - Missing Authorization
Fixed in
Fixed in 1.9.0
CVSS
5.3 (medium)