WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wpc-badge-management
Published
2024-03-29
Title
WPC Badge Management for WooCommerce < 2.4.1 - Missing Authorization
Slug
wpc-composite-products
Published
2024-04-26
Title
WPC Composite Products for WooCommerce < 7.2.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Slug
wpc-countdown-timer
Published
2025-10-20
Title
WPC Countdown Timer for WooCommerce < 3.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wpc-grouped-product
Published
2024-04-15
Title
WPC Grouped Product for WooCommerce < 4.4.3 - Missing Authorization
Slug
wpc-name-your-price
Published
2025-10-30
Title
WPC Name Your Price for WooCommerce < 2.2.0 - Unauthenticated Price Alteration
Slug
wpc-product-options
Published
2025-05-16
Title
WPC Product Options for WooCommerce <= 1.8.6 - Authenticated (Subscriber+) Local File Inclusion
Slug
wpc-shop-as-customer
Published
2024-10-24
Title
WPC Shop as a Customer for WooCommerce < 1.2.7 - Authenticated (Subscriber+) PHP Object Injection
Slug
wpc-shop-as-customer
Published
2024-12-17
Title
WPC Shop as a Customer for WooCommerce < 1.2.9 - Authentication Bypass Due to Insufficiently Unique Key
Slug
wpc-smart-linked-products
Published
2025-04-01
Title
WPC Smart Linked Products < 1.3.6 - Contributor+ Privilege Escalation
Slug
wpc-smart-messages
Published
2024-10-28
Title
WPC Smart Messages for WooCommerce < 4.2.2 - Authenticated (Subscriber+) Local File Inclusion
Slug
wpc-smart-messages
Published
2024-10-28
Title
WPC Smart Messages for WooCommerce < 4.2.2 - Missing Authorization to Authenticated (Subscriber+) Message Activation/Deactivation
Slug
wpc-smart-messages
Published
2025-09-28
Title
WPC Smart Messages for WooCommerce <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wpc-smart-upsell-funnel
Published
2025-03-27
Title
WPC Smart Upsell Funnel for WooCommerce < 3.0.5 - Authenticated (Subscriber+) Arbitrary Options Update
Slug
wpcal
Published
2024-04-22
Title
WPCal.io – Easy Meeting Scheduler < 0.9.5.9 - Cross-Site Request Forgery
Slug
wpcal
Published
2025-12-30
Title
WPCal.io < 0.9.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wpcalc
Published
2021-12-06
Title
WPcalc <= 2.1 - Authenticated SQL Injection
Slug
wpcargo
Published
2022-02-21
Title
WPCargo < 6.9.0 - Unauthenticated RCE
Slug
wpcargo
Published
2022-04-25
Title
WPCargo Track & Trace < 6.9.5 - Reflected Cross Site Scripting
Slug
wpcargo
Published
2022-04-25
Title
WPCargo Track & Trace < 6.9.5 - Admin+ Stored Cross Site Scripting
Slug
wpcargo
Published
2024-09-16
Title
WPCargo Track & Trace <= 8.0.2 - Unauthenticated SQL Injection
Slug
wpcargo
Published
2024-12-11
Title
WPCargo Track & Trace <= 8.0.2 - Subscriber+ Settings Update
Slug
wpcargo
Published
2025-03-31
Title
WPCargo Track & Trace <= 8.0.2 - Contributor+ Insecure Direct Object Reference
Slug
wpcasa
Published
2024-12-02
Title
WPCasa < 1.3.0 - Insecure Direct Object Reference
Slug
wpcasa
Published
2025-04-16
Title
WPCasa < 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wpcasa
Published
2025-09-22
Title
WPCasa < 1.4.2 - Unauthenticated Code Injection