WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
store-manager-connector
Published
2025-05-23
Title
eMagicOne Store Manager for WooCommerce < 1.3.0 - Unauthenticated Arbitrary File Deletion
Slug
store-manager-connector
Published
2025-05-23
Title
eMagicOne Store Manager for WooCommerce < 1.3.0 - Unauthenticated Arbitrary File Upload via set_file()
Slug
store-manager-connector
Published
2025-05-23
Title
eMagicOne Store Manager for WooCommerce < 1.3.0 - Unauthenticated Arbitrary File Upload via set_image()
Slug
store-manager-connector
Published
2026-05-07
Title
eMagicOne Store Manager for WooCommerce <= 1.3.2 - Unauthenticated SQL Injection
Slug
storecontrl-wp-connection
Published
2025-04-17
Title
StoreContrl Woocommerce < 4.1.4 - Unauthenticated Arbitrary File Download
Slug
storeengine
Published
2025-09-16
Title
StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More < 1.5.1 - Authenticated (Subscriber+) Arbitrary File Download
Slug
storeengine
Published
2025-09-16
Title
StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More < 1.5.1 - Authenticated (Subscriber+) Arbitrary File Upload
Slug
storeengine
Published
2026-08-15
Title
StoreEngine < 2.2.0 - Authenticated (Vendor+) Arbitrary File Read via Path Traversal in Downloadable File URL
Slug
storefront-footer-text
Published
2021-10-11
Title
Storefront Footer Text <= 1.0.1 - Admin+ Stored Cross-Site Scripting
Slug
storegrowth-sales-booster
Published
2026-07-27
Title
StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart < 2.1.1 - Unauthenticated Stored Cross-Site Scripting via 'message_popup' Parameter
Slug
storegrowth-sales-booster
Published
2026-07-27
Title
StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart < 2.1.1 - Missing Authorization to Unauthenticated Options Update via create_popup AJAX Action
Slug
storegrowth-sales-booster
Published
2026-07-27
Title
StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart < 2.1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via bogo_category_msg_create AJAX Action
Slug
storegrowth-sales-booster
Published
2026-08-10
Title
StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce < 2.1.2 - Missing Authorization
Slug
storegrowth-sales-booster
Published
2026-08-25
Title
StoreGrowth: Smart Sales Booster for WooCommerce < 2.1.2 - Unauthenticated Arbitrary Price Manipulation via BOGO Add-to-Cart
Slug
storegrowth-sales-booster
Published
2026-10-05
Title
StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce < 2.1.1 - Unauthenticated Stored Cross-Site Scripting
Slug
storekeeper-for-woocommerce
Published
2025-05-09
Title
StoreKeeper for WooCommerce < 14.4.5 - Unauthenticated Arbitrary File Upload
Slug
storekeeper-for-woocommerce
Published
2025-07-31
Title
StoreKeeper for WooCommerce < 14.4.5 - Unauthenticated Arbitrary File Upload
Slug
story-chief
Published
2021-08-02
Title
StoryChief < 1.0.31 - Reflected Cross-Site Scripting (XSS)
Slug
story-chief
Published
2021-08-02
Title
StoryChief < 1.0.31 - Authenticated Stored Cross-Site Scripting (XSS)
Slug
story-chief
Published
2025-08-15
Title
StoryChief < 1.0.43 - Unauthenticated Arbitrary File Upload
Slug
storyform
Published
2025-06-18
Title
Storyform <= 0.6.14 - Reflected Cross-Site Scripting
Slug
stout-google-calendar
Published
2023-10-16
Title
Stout Google Calendar <= 1.2.3 - Arbitrary Settings Update via CSRF
Slug
strabl-a-checkout-solution
Published
2026-06-18
Title
STRABL < 4.6 - Unauthenticated Arbitrary Webhook Creation via REST API Endpoint
Slug
strategery-migrations
Published
2024-06-06
Title
Strategery Migrations <= 1.0 - Unauthenticated Arbitrary File Deletion
Slug
stratum
Published
2024-03-25
Title
Stratum < 1.3.16 - Authenticated (Contributor+) Stored Cross-Site Scripting