WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wc-support-system
Published
2026-05-12
Title
ilGhera Support System for WooCommerce < 1.3.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure
Slug
wc-tabs
Published
2025-02-27
Title
Tabs for WooCommerce <= 1.0.0 - Authentiated (Shop Manager+) PHP Object Injection in product_has_custom_tabs
Slug
wc-thanks-redirect
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
wc-thanks-redirect
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
wc-thanks-redirect
Published
2026-04-30
Title
Freemius < 2.11.0 - Reflected DOM-Based XSS via url Parameter
Slug
wc-ukr-shipping
Published
2026-09-03
Title
SmartyParcel – Multi-Carrier Shipping, Order Tracking & Live Rates for WooCommerce < 1.23.4 - Authenticated (Subscriber+) Insecure Direct Object Reference
Slug
wc-ukr-shipping
Published
2026-10-03
Title
SmartyParcel – Shipping Automation & Order Tracking for GLS, InPost, Nova Post and more < 1.23.3 - Missing Authorization
Slug
wc-ukr-shipping
Published
2026-10-19
Title
SmartyParcel (WC Ukr Shipping) < 1.23.4 - Subscriber+ Arbitrary Shipping Label Deletion
Slug
wc-ukr-shipping
Published
2026-10-19
Title
SmartyParcel < 1.23.4 - Unauthenticated Shipping Label Disclosure via IDOR
Slug
wc-vendors
Published
2023-01-11
Title
WC Vendors Marketplace < 2.4.5 - Contributor+ Stored XSS
Slug
wc-vendors
Published
2023-11-23
Title
WC Vendors Marketplace < 2.4.7.1 - Authenticated (Shop manager+) SQL Injection via search dates
Slug
wc-vendors
Published
2025-06-05
Title
WC Vendors Marketplace < 2.5.7 - Authenticated (Administrator+) SQL Injection
Slug
wc-vendors
Published
2025-12-04
Title
WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors < 2.6.4.1 - Cross-Site Request Forgery to Vendor Product Deletion
Slug
wc-vendors
Published
2026-06-18
Title
WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors < 2.6.9 - Authenticated (Subscriber+) SQL Injection
Slug
wc-vendors
Published
2026-08-15
Title
WC Vendors < 2.7.1 - Authenticated (Shop Manager+) SQL Injection via 'status' Parameter
Slug
wc-vendors
Published
2026-08-31
Title
WC Vendors < 2.7.2.1 - Order Shipment Status Change via CSRF
Slug
wc-vendors
Published
2026-08-31
Title
WC Vendors < 2.7.2.1 - Vendor+ Cross-Vendor Product and Arbitrary Post Modification via IDOR
Slug
wc-vendors
Published
2026-08-31
Title
WC Vendors < 2.7.2.1 - Vendor+ Cross-Vendor Order Shipment Status Change
Slug
wc-vendors
Published
2026-09-17
Title
WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors < 2.7.2.2 - Authenticated (Administrator+) SQL Injection
Slug
wc-venipak-shipping
Published
2024-03-25
Title
Shipping with Venipak for WooCommerce < 1.19.6 - Reflected Cross-Site Scripting via 'venipak_labels_link'
Slug
wc-wallet
Published
2025-01-16
Title
WC Wallet <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion
Slug
wc-walletdoc-payment-gateway
Published
2026-10-12
Title
Walletdoc Payment Gateway for WooCommerce < 1.8.5 - Unauthenticated SQLi and Order Payment Forgery via Webhook
Slug
wc-zelle
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
wc-zelle
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
wc1c-main
Published
2025-01-06
Title
WC1C <= 0.23.0 - Reflected Cross-Site Scripting