Plugin icon

Return Refund and Exchange For WooCommerce

woo-refund-and-exchange-lite

Vulnerabilities:

7

Last Updated:

August 17, 2026

Active Installs:

4000

Published
Title
Fixed in
CVSS
Published
2026-09-08
Title
Return Refund and Exchange For WooCommerce <= 4.6.4 - Missing Authorization
Fixed in
No known fix
CVSS
5.3 (medium)
Published
2026-08-24
Title
Woo Refund And Exchange Lite < 4.6.4 - Unauthenticated Guest Order Message Disclosure and Manipulation
Fixed in
Fixed in 4.6.4
CVSS
6.5 (medium)
Published
2025-11-20
Title
Return Refund and Exchange For WooCommerce < 4.5.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Refund Request Cancellation
Fixed in
Fixed in 4.5.6
CVSS
4.3 (medium)
Published
2025-11-20
Title
Return Refund and Exchange For WooCommerce < 4.5.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Order Message Read
Fixed in
Fixed in 4.5.6
CVSS
5.4 (medium)
Published
2025-02-13
Title
Return Refund and Exchange For WooCommerce < 4.4.6 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
Fixed in
Fixed in 4.4.6
CVSS
5.9 (medium)
Published
2025-02-13
Title
Return Refund and Exchange For WooCommerce < 4.4.6 - Subscriber+ IDOR
Fixed in
Fixed in 4.4.6
CVSS
5.4 (medium)
Published
2022-12-05
Title
Return Refund and Exchange For WooCommerce < 4.0.9 - Unauthenticated Arbitrary File Upload
Fixed in
Fixed in 4.0.9
CVSS
10.0 (critical)