WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
woo-nmi-three-step
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
woo-nmi-three-step
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
woo-one-click-upsell-funnel
Published
2024-12-20
Title
One Click Upsell Funnel for WooCommerce < 3.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via wps_wocuf_pro_yes Shortcode
Slug
woo-order-export-lite
Published
2018-06-20
Title
Advanced Order Export For WooCommerce <= 1.5.4 - CSV Injection
Slug
woo-order-export-lite
Published
2020-05-04
Title
Advanced Order Export For WooCommerce < 3.1.4 - Authenticated Cross-Site Scripting (XSS)
Slug
woo-order-export-lite
Published
2021-03-03
Title
Advanced Order Export For WooCommerce < 3.1.8 - Authenticated Reflected Cross-Site Scripting (XSS)
Slug
woo-order-export-lite
Published
2022-08-25
Title
Advanced Order Export For WooCommerce < 3.3.2 - Reflected Cross-Site Scripting
Slug
woo-order-export-lite
Published
2022-10-20
Title
Advanced Order Export For WooCommerce < 3.3.3 - Export Files via CSRF
Slug
woo-order-export-lite
Published
2024-04-05
Title
Advanced Order Export For WooCommerce < 3.4.5 - Shop Manager+ Remote Code Execution
Slug
woo-order-export-lite
Published
2024-11-12
Title
Advanced Order Export For WooCommerce < 3.5.6 - Unauthenticated PHP Object Injection via Order Details
Slug
woo-order-notes
Published
2024-12-10
Title
WPC Order Notes for WooCommerce < 1.5.3 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
Slug
woo-order-splitter
Published
2025-04-01
Title
Order Splitter for WooCommerce < 5.3.1 - Authenticated (Subscriber+) SQL Injection
Slug
woo-order-splitter
Published
2026-02-17
Title
Order Splitter for WooCommerce < 5.3.6 - Missing Authorization to Authenticated (Subscriber+) Order Information Exposure
Slug
woo-order-status-per-product
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
woo-order-status-per-product
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
woo-orders-tracking
Published
2021-12-27
Title
Orders Tracking for WooCommerce < 1.1.10 - Reflected Cross-Site Scripting
Slug
woo-orders-tracking
Published
2023-08-14
Title
Orders Tracking for WooCommerce < 1.2.6 - Admin+ Arbitrary File Access/Read
Slug
woo-orders-tracking
Published
2024-05-09
Title
Orders Tracking for WooCommerce < 1.2.11 - Unauthenticated Arbitrary Shortcode Execution
Slug
woo-oscommerce-sync
Published
2025-02-02
Title
Woocommerce osCommerce Sync <= 2.0.20 - Unauthenticated Stored Cross-Site Scripting
Slug
woo-parcel-pro
Published
2023-10-25
Title
Parcel Pro < 1.6.12 - Open Redirect
Slug
woo-parcel-pro
Published
2023-11-22
Title
WooCommerce Parcel Pro < 1.6.12 - Cross-Site Request Forgery
Slug
woo-parcel-pro
Published
2024-10-17
Title
Parcel Pro < 1.9.0 - Reflected Cross-Site Scripting
Slug
woo-paylate
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
woo-paylate
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
woo-payment-bkash
Published
2025-11-20
Title
Payment Gateway bKash for WC <= 3.1.0 - Missing Authorization