WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
woo-quickview
Published
2025-11-26
Title
Quick View for WooCommerce < 2.2.18 - Unauthenticated Private Product Disclosure
Slug
woo-quote-calculator-order
Published
2024-10-25
Title
Woocommerce Quote Calculator <= 1.1 - Unauthenticated SQL Injection
Slug
woo-quote-calculator-order
Published
2024-10-31
Title
Woocommerce Quote Calculator <= 1.1 - Authenticated (Contributor+) SQL Injection
Slug
woo-razorpay
Published
2023-11-28
Title
Razorpay for WooCommerce < 4.5.7 - Subscriber+ Transfers Manipulation
Slug
woo-razorpay
Published
2023-11-28
Title
Razorpay for WooCommerce < 4.5.7 - Transfers Manipulation via CSRF
Slug
woo-razorpay
Published
2026-02-18
Title
Razorpay for WooCommerce < 4.7.9 - Unauthenticated Order Modification
Slug
woo-razorpay
Published
2026-02-16
Title
Razorpay for WooCommerce < 4.8.4 - Missing Authorization
Slug
woo-razorpay
Published
2026-08-17
Title
Razorpay for WooCommerce < 4.8.8 - Unauthenticated Insecure Direct Object Reference
Slug
woo-razorpay
Published
2026-10-02
Title
Razorpay for WooCommerce < 4.8.8 - Unauthenticated Order Shipping Modification via IDOR
Slug
woo-recargo-de-equivalencia
Published
2025-02-24
Title
WooCommerce Recargo de Equivalencia <= 1.6.24 - Cross-Site Request Forgery
Slug
woo-recent-purchases
Published
2024-05-27
Title
Woocommerce – Recent Purchases <= 1.0.1 - Authenticated (Admin+) Local File Inclusion
Slug
woo-rede
Published
2026-01-15
Title
Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit < 5.1.3 - Unauthenticated Order Status Manipulation
Slug
woo-rede
Published
2026-01-15
Title
Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit < 5.1.6 - Missing Authorization to Unauthenticated Rede Order Logs Deletion
Slug
woo-rede
Published
2026-09-17
Title
Rede Itaú for WooCommerce < 5.4.7 - Unauthenticated Order Status Manipulation via PIX Webhook
Slug
woo-rede
Published
2026-10-13
Title
Rede Itaú for WooCommerce < 5.5.3 - Unauthenticated Order Status Manipulation via 3DS Failure Webhook
Slug
woo-rede
Published
2026-10-13
Title
Rede Itaú for WooCommerce 3.7.1 - 5.5.2 - Unauthenticated Order Status Manipulation via maxiPago Debit Webhook
Slug
woo-redsys-gateway-light
Published
2026-04-15
Title
Payment Gateway for Redsys & WooCommerce Lite < 7.0.1 - Improper Verification of Cryptographic Signature to Unauthenticated Payment Status Manipulation
Slug
woo-redsys-gateway-light
Published
2026-04-16
Title
Payment Gateway for Redsys & WooCommerce Lite < 7.0.1 - Missing Authorization
Slug
woo-redsys-gateway-light
Published
2026-06-29
Title
Payment Gateway for Redsys & WooCommerce Lite < 7.0.2 - Unauthenticated Payment Confirmation via Unverified Inespay Callback
Slug
woo-refund-and-exchange-lite
Published
2022-12-05
Title
Return Refund and Exchange For WooCommerce < 4.0.9 - Unauthenticated Arbitrary File Upload
Slug
woo-refund-and-exchange-lite
Published
2025-02-13
Title
Return Refund and Exchange For WooCommerce < 4.4.6 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
Slug
woo-refund-and-exchange-lite
Published
2025-02-13
Title
Return Refund and Exchange For WooCommerce < 4.4.6 - Subscriber+ IDOR
Slug
woo-refund-and-exchange-lite
Published
2025-11-20
Title
Return Refund and Exchange For WooCommerce < 4.5.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Refund Request Cancellation
Slug
woo-refund-and-exchange-lite
Published
2025-11-20
Title
Return Refund and Exchange For WooCommerce < 4.5.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Order Message Read
Slug
woo-refund-and-exchange-lite
Published
2026-08-24
Title
Woo Refund And Exchange Lite < 4.6.4 - Unauthenticated Guest Order Message Disclosure and Manipulation