WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
woocommerce-notify-updated-product
Published
2025-09-05
Title
Woocommerce Notify Updated Product <= 1.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
woocommerce-openpos
Published
2024-07-09
Title
Woocommerce OpenPos < 7.0.1 - Unauthenticated SQL Injection
Slug
woocommerce-openpos
Published
2024-07-09
Title
Woocommerce OpenPos < 7.0.1 - Unauthenticated Arbitrary File Deletion
Slug
woocommerce-openpos
Published
2024-07-09
Title
Woocommerce OpenPos < 7.0.2 - Unauthenticated Sensitive Information Disclosure
Slug
woocommerce-order-address-print
Published
2023-05-30
Title
Woocommerce Order address Print <= 3.2 - Reflected XSS
Slug
woocommerce-order-barcodes
Published
2023-07-17
Title
WooCommerce Order Barcodes < 1.6.5 - Cross-Site Request Forgery
Slug
woocommerce-order-searching
Published
2025-01-16
Title
WooCommerce Order Search <= 1.1.0 - Reflected Cross-Site Scripting
Slug
woocommerce-order-status-change-notifier
Published
2023-04-19
Title
WooCommerce Order Status Change Notifier <= 1.1.0 - Subscriber+ Arbitrary Order Status Update
Slug
woocommerce-orders-customers-exporter
Published
2025-05-30
Title
WooCommerce Orders & Customers Exporter <= 5.0 - Authenticated (Subscriber+) Information Exposure
Slug
woocommerce-orders-ei
Published
2025-09-19
Title
WooCommerce Orders & Customers Exporter <= 5.4 - Missing Authorization
Slug
woocommerce-orders-ei
Published
2026-01-08
Title
WooCommerce Orders & Customers Exporter <= 5.4 - Authenticated (Subscriber+) SQL Injection
Slug
woocommerce-parcelas
Published
2025-12-31
Title
WooCommerce Parcelas <= 1.3.5 - Authenticated (Shop manager+) Stored Cross-Site Scripting
Slug
woocommerce-pay-per-post
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
woocommerce-pay-per-post
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
woocommerce-paymaster-gateway-019
Published
2025-07-03
Title
PayMaster for WooCommerce <= 0.4.31 - Authenticated (Subscriber+) Server-Side Request Forgery
Slug
woocommerce-payment-gateway-for-saferpay
Published
2025-08-26
Title
WooCommerce Payment Gateway for Saferpay <= 0.4.9 - Unauthenticated Path Traversal
Slug
woocommerce-payments
Published
2023-03-23
Title
WooCommerce Payments < 5.6.2 - Unauthenticated Privilege Escalation
Slug
woocommerce-payments
Published
2023-06-22
Title
WooCommerce Payments < 4.5.1 - Intent Parameter Tampering
Slug
woocommerce-payments
Published
2023-09-11
Title
WooCommerce Payments < 4.9.0 - Subscription Suspension/Activation via CSRF
Slug
woocommerce-payments
Published
2023-12-05
Title
WooCommerce Payments < 6.5.0 - Contributor+ Cross-Site Scripting
Slug
woocommerce-payments
Published
2023-12-27
Title
WooPayments < 6.7.0 - Unauthenticated Order Deletion via IDOR
Slug
woocommerce-payments
Published
2023-12-20
Title
WooCommerce Payments < 5.9.1 - Shop Manager+ SQLi
Slug
woocommerce-paypal-payments
Published
2023-06-20
Title
WooCommerce PayPal Payments < 2.0.5 - Merchant ID Details Update via CSRF
Slug
woocommerce-payplug
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
woocommerce-payplug
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting