WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
woo-refund-and-exchange-lite
Published
2026-09-08
Title
Return Refund and Exchange For WooCommerce < 4.6.5 - Missing Authorization
Slug
woo-related-products-refresh-on-reload
Published
2023-10-29
Title
Related Products for WooCommerce < 3.3.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Slug
woo-remove-cart-and-query-button
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
woo-remove-cart-and-query-button
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
woo-reviews-by-wiremo
Published
2025-12-31
Title
Wiremo <= 1.4.99 - Missing Authorization
Slug
woo-rfq-for-woocommerce
Published
2025-03-19
Title
NP Quote Request for WooCommerce < 1.9.180 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure
Slug
woo-rfq-for-woocommerce
Published
2026-09-21
Title
NP Quote Request for WooCommerce < 2.4.16 - Unauthenticated Order Data Disclosure via Quote Request Page
Slug
woo-sadad-payment-gateway
Published
2026-10-25
Title
Sadad QA Payment 1.28 - Unauthenticated Arbitrary Order Payment Confirmation via Signature Bypass
Slug
woo-salesforce-plugin-crm-perks
Published
2021-08-26
Title
Multiple Plugins from CRM Perks - Reflected Cross-Site Scripting
Slug
woo-salesforce-plugin-crm-perks
Published
2025-05-07
Title
Integration for WooCommerce and Salesforce < 1.7.6 - Open Redirect
Slug
woo-save-abandoned-carts
Published
2024-09-30
Title
CartBounty – Save and recover abandoned carts for WooCommerce < 8.2.1 - Cross-Site Request Forgery
Slug
woo-seo-addon
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
woo-seo-addon
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
woo-seo-content-randomizer-addon
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
woo-shipping-display-mode
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
woo-shipping-display-mode
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
woo-shipping-dpd-baltic
Published
2022-11-16
Title
WooCommerce Shipping - DPD baltic < 1.2.11 - Admin+ Stored XSS
Slug
woo-shipping-dpd-baltic
Published
2022-11-21
Title
WooCommerce Shipping - DPD baltic < 1.2.57 - Subscriber+ Arbitrary Options Deletion
Slug
woo-shipping-dpd-baltic
Published
2024-10-17
Title
DPD Baltic Shipping < 1.2.84 - Reflected Cross-Site Scripting
Slug
woo-shirt-product-designer
Published
2026-09-09
Title
Shirt Product Designer for WooCommerce 1.0.4 - Missing Authorization
Slug
woo-show-single-variations-shop-category
Published
2025-11-28
Title
Show Variations as Single Products Woocommerce < 3.0 - Missing Authorization
Slug
woo-simple-frontend-manager
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
woo-simple-frontend-manager
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
woo-single-page-checkout
Published
2025-09-05
Title
WooCommerce Single Page Checkout <= 1.2.7 - Cross-Site Request Forgery
Slug
woo-slider-pro-drag-drop-slider-builder-for-woocommerce
Published
2025-05-29
Title
Woo Slider Pro - Drag Drop Slider Builder For WooCommerce <= 1.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion