WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
woo-moneybird
Published
2021-09-09
Title
Integration of Moneybird for WooCommerce <= 2.1.1 - Reflected Cross-Site Scripting
Slug
woo-mstoreapp-mobile-app
Published
2025-10-31
Title
Mstoreapp Mobile (App <= 2.08, Multivendor <= 9.0.1) - Unauthenticated Privilege Escalation
Slug
woo-multi-currency
Published
2022-05-31
Title
CURCY < 2.1.18 - Reflected Cross-Site Scripting
Slug
woo-multi-currency
Published
2024-10-15
Title
CURCY < 2.2.4 - Reflected Cross-Site Scripting
Slug
woo-multi-currency
Published
2025-02-05
Title
CURCY – Multi Currency for WooCommerce < 2.2.6 - Unauthenticated Arbitrary Shortcode Execution via get_products_price Function
Slug
woo-myghpay-payment-gateway
Published
2021-12-14
Title
WooCommerce myghpay Payment Gateway <= 3.0 - Reflected Cross-Site Scripting
Slug
woo-nmi-three-step
Published
2021-07-05
Title
NMI Gateway For WooCommerce <= 1.6.11 - CSRF Bypass
Slug
woo-nmi-three-step
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
woo-nmi-three-step
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
woo-one-click-upsell-funnel
Published
2024-12-20
Title
One Click Upsell Funnel for WooCommerce < 3.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via wps_wocuf_pro_yes Shortcode
Slug
woo-order-export-lite
Published
2018-06-20
Title
Advanced Order Export For WooCommerce <= 1.5.4 - CSV Injection
Slug
woo-order-export-lite
Published
2020-05-04
Title
Advanced Order Export For WooCommerce < 3.1.4 - Authenticated Cross-Site Scripting (XSS)
Slug
woo-order-export-lite
Published
2021-03-03
Title
Advanced Order Export For WooCommerce < 3.1.8 - Authenticated Reflected Cross-Site Scripting (XSS)
Slug
woo-order-export-lite
Published
2022-08-25
Title
Advanced Order Export For WooCommerce < 3.3.2 - Reflected Cross-Site Scripting
Slug
woo-order-export-lite
Published
2022-10-20
Title
Advanced Order Export For WooCommerce < 3.3.3 - Export Files via CSRF
Slug
woo-order-export-lite
Published
2024-04-05
Title
Advanced Order Export For WooCommerce < 3.4.5 - Shop Manager+ Remote Code Execution
Slug
woo-order-export-lite
Published
2024-11-12
Title
Advanced Order Export For WooCommerce < 3.5.6 - Unauthenticated PHP Object Injection via Order Details
Slug
woo-order-notes
Published
2024-12-10
Title
WPC Order Notes for WooCommerce < 1.5.3 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
Slug
woo-order-splitter
Published
2025-04-01
Title
Order Splitter for WooCommerce < 5.3.1 - Authenticated (Subscriber+) SQL Injection
Slug
woo-order-status-per-product
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
woo-order-status-per-product
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
woo-orders-tracking
Published
2021-12-27
Title
Orders Tracking for WooCommerce < 1.1.10 - Reflected Cross-Site Scripting
Slug
woo-orders-tracking
Published
2023-08-14
Title
Orders Tracking for WooCommerce < 1.2.6 - Admin+ Arbitrary File Access/Read
Slug
woo-orders-tracking
Published
2024-05-09
Title
Orders Tracking for WooCommerce < 1.2.11 - Unauthenticated Arbitrary Shortcode Execution
Slug
woo-oscommerce-sync
Published
2025-02-02
Title
Woocommerce osCommerce Sync <= 2.0.20 - Unauthenticated Stored Cross-Site Scripting