WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
carrrot
Published
2023-09-06
Title
Carrot <= 1.1.0 - Admin+ Stored XSS
Slug
cars-seller-auto-classifieds-script
Published
2021-04-26
Title
Car Seller - Auto Classifieds Script <= 2.1.0 - Unauthenticated SQL Injection
Slug
cart-lift
Published
2023-05-04
Title
Cart Lift < 3.1.6 - Reflected XSS
Slug
cart-lift
Published
2026-07-08
Title
Cart Lift – Abandoned Cart Recovery for WooCommerce and EDD < 3.1.58 - Unauthenticated Stored Cross-Site Scripting
Slug
cart-rest-api-for-woocommerce
Published
2023-11-07
Title
CoCart – Headless ecommerce < 3.12.0 - Missing Authorization
Slug
cart-rest-api-for-woocommerce
Published
2026-07-20
Title
CoCart < 4.9.0 - Unauthenticated Arbitrary Price Manipulation
Slug
cart-rest-api-for-woocommerce
Published
2026-07-23
Title
CoCart – Headless REST API for WooCommerce < 4.9.0 - Missing Authorization
Slug
cart-rest-api-for-woocommerce
Published
2026-10-02
Title
CoCart 4.9.0 - 4.9.6 - Administrator Account Creation via REST API Authentication Bypass
Slug
cart-tracking-for-woocommerce
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
cart-tracking-for-woocommerce
Published
2025-03-27
Title
Cart tracking for WooCommerce < 1.0.17 - Authenticated (Administrator+) SQL Injection
Slug
cart-tracking-for-woocommerce
Published
2025-05-07
Title
Cart tracking for WooCommerce < 1.0.18 - Authenticated (Administrator+) SQL Injection
Slug
cart-weight-for-woocommerce
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
cart-weight-for-woocommerce
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
cart66
Published
2015-01-01
Title
Cart66 Pro <= 1.5.3 - Authenticated Arbitrary File Disclosure
Slug
cart66-cloud
Published
2025-04-11
Title
Cart66 Cloud <= 2.3.7 - Unauthenticated Information Exposure
Slug
cart66-cloud
Published
2025-04-10
Title
Cart66 Cloud <= 2.3.7 - Reflected Cross-Site Scripting
Slug
cart66-lite
Published
2014-08-01
Title
Cart66 Lite 1.5.1.14 - admin.php cart66-products Page Product Manipulation CSRF
Slug
cart66-lite
Published
2014-08-01
Title
Cart66 Lite - admin.php cart66-products Page Multiple Field Stored XSS
Slug
cart66-lite
Published
2014-12-03
Title
Cart66 Lite < 1.5.2 - Blind SQL Injection
Slug
cart66-lite
Published
2015-01-01
Title
Cart66 Lite <= 1.5.3 - SQL Injection
Slug
cart66-lite
Published
2015-01-26
Title
Cart66 Lite 1.5.4 - XSS
Slug
carta-online
Published
2026-03-06
Title
Carta Online < 2.15.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
Slug
cartasi-x-pay
Published
2026-04-14
Title
Nexi XPay < 8.3.2 - Missing Authorization to Unauthenticated Order Status Modification
Slug
cartasi-x-pay
Published
2026-06-17
Title
Nexi XPay < 8.3.2 - Missing Authorization
Slug
cartboss
Published
2025-04-01
Title
SMS Abandoned Cart Recovery ✦ CartBoss < 4.1.3 - Missing Authorization