WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
product-blocks
Published
2024-01-30
Title
ProductX – WooCommerce Builder & Gutenberg WooCommerce Blocks < 3.1.5 - PHP Object Injection via wopb_wishlist and wopb_compare
Slug
product-blocks
Published
2025-04-16
Title
WowStore < 4.2.5 - Missing Authorization
Slug
product-blocks
Published
2026-03-16
Title
WowStore – Store Builder & Product Blocks for WooCommerce < 4.4.4 - Unauthenticated SQL Injection via 'search' Parameter
Slug
product-blocks-for-woocommerce
Published
2025-02-03
Title
Product Blocks for WooCommerce < 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
product-carousel-slider-for-woocommerce
Published
2023-11-13
Title
WooCommerce Product Carousel Slider <= 3.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Slug
product-catalog-8
Published
2016-11-28
Title
Product Catalog 8 1.2 - Unauthenticated SQL Injection
Slug
product-catalog-feed
Published
2023-04-10
Title
Product Catalog Feed by PixelYourSite < 2.1.1 - Reflected XSS
Slug
product-catalog-feed
Published
2023-04-10
Title
Product Catalog Feed by PixelYourSite < 2.1.1 - Reflected XSS
Slug
product-catalog-feed
Published
2023-12-05
Title
Product Catalog Feed by PixelYourSite < 2.2.0 - Cross-Site Request Forgery
Slug
product-categories-designs-for-woo-pro
Published
2026-04-13
Title
Multiple Plugins by "Essential Plugin" - Backdoor
Slug
product-category-tree
Published
2023-10-18
Title
Product Category Tree <= 2.5 - Reflected XSS
Slug
product-category-tree
Published
2023-10-17
Title
Product Category Tree <= 2.5 - CSRF
Slug
product-code-for-woocommerce
Published
2023-12-27
Title
Product Code for WooCommerce < 1.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
product-code-for-woocommerce
Published
2025-05-19
Title
Product Code for WooCommerce < 1.5.1 - Cross-Site Request Forgery to Database Update
Slug
product-configurator-for-woocommerce
Published
2022-06-06
Title
Product Configurator for WooCommerce < 1.2.32 - Unauthenticated Arbitrary File Deletion
Slug
product-configurator-for-woocommerce
Published
2025-07-30
Title
Product Configurator for WooCommerce < 1.5.0 - Cross-Site Request Forgery
Slug
product-configurator-for-woocommerce
Published
2026-06-10
Title
Product Configurator for WooCommerce < 1.7.3 - Unauthenticated Private/Draft Product Data Disclosure via pc_get_data
Slug
product-countdown-for-woocommerce
Published
2025-05-07
Title
Product Time Countdown for WooCommerce < 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
product-countdown-for-woocommerce
Published
2025-09-22
Title
Product Time Countdown for WooCommerce <= 1.6.4 - Authenticated (Shop manager+) Stored Cross-Site Scripting
Slug
product-customizer-light
Published
2024-10-17
Title
Product Customizer Light <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Slug
product-delivery-date
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
product-delivery-date-for-woocommerce-lite
Published
2024-01-03
Title
Product Delivery Date for WooCommerce – Lite < 2.7.1 - Missing Authorization
Slug
product-delivery-date-for-woocommerce-lite
Published
2024-07-11
Title
Product Delivery Date for WooCommerce – Lite < 2.7.3 - Missing Authorization
Slug
product-delivery-date-for-woocommerce-lite
Published
2024-10-03
Title
Product Delivery Date for WooCommerce – Lite < 2.7.4 - Reflected Cross-Site Scripting
Slug
product-delivery-date-for-woocommerce-lite
Published
2024-11-12
Title
Product Delivery Date for WooCommerce - Lite < 2.8.1 - Reflected Cross-Site Scripting