WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
woocommerce-anti-fraud
Published
2020-11-22
Title
WooCommerce Anti-Fraud < 3.9 - Unauthenticated Order Status Manipulation
Slug
woocommerce-anti-fraud
Published
2026-06-08
Title
WooCommerce Anti-Fraud < 7.2.7 - Missing Authorization
Slug
woocommerce-appointments
Published
2026-08-10
Title
WooCommerce Appointments <= 5.3.8 - Unauthenticated Information Exposure
Slug
woocommerce-aweber-newsletter-subscription
Published
2024-04-30
Title
WooCommerce AWeber Newsletter Subscription < 4.0.3 - Missing Authorization to Access Token Modification
Slug
woocommerce-basic-ordernumbers
Published
2024-12-14
Title
WooCommerce Basic Ordernumbers <= 1.4.4 - Missing Authorization
Slug
woocommerce-beta-tester
Published
2023-09-12
Title
WooCommerce Beta Tester < 2.2.4 - Admin+ SQLi
Slug
woocommerce-booking
Published
2024-11-25
Title
Booking & Appointment Plugin for WooCommerce < 6.10.0 - Subscriber+ Arbitrary Option Update
Slug
woocommerce-bookings
Published
2023-11-14
Title
WooCommerce Bookings < 2.0.4 - Cross-Site Request Forgery
Slug
woocommerce-bookings
Published
2025-03-12
Title
WooCommerce Bookings < 2.2.5 - Unauthenticated Bookings Products Data and Metadata Disclosure via REST API
Slug
woocommerce-bookings
Published
2026-08-21
Title
WooCommerce Bookings < 3.9.0 - Subscriber+ Draft Bookable Product Creation via Missing Authorization
Slug
woocommerce-box-office
Published
2023-06-02
Title
WooCommerce Box Office < 1.1.51 - Contributor+ Stored XSS
Slug
woocommerce-box-office
Published
2023-06-02
Title
WooCommerce Box Office < 1.1.52 - Unauthenticated Ticket Barcode Update
Slug
woocommerce-box-office
Published
2024-01-31
Title
WooCommerce Box Office < 1.2.3 - Missing Authorization
Slug
woocommerce-brands
Published
2023-05-15
Title
WooCommerce Brands < 1.6.46 - Contributor+ Stored XSS
Slug
woocommerce-brands
Published
2023-07-17
Title
WooCommerce Brands < 1.6.50 - Cross-Site Request Forgery
Slug
woocommerce-bulk-order-form
Published
2023-05-31
Title
Quick/Bulk Order Form for WooCommerce < 3.6.0 - Shop Manager+ Stored XSS
Slug
woocommerce-bulk-stock-management
Published
2023-06-20
Title
WooCommerce Bulk Stock Management < 2.2.34 - Reflected XSS
Slug
woocommerce-call-for-price
Published
2026-05-01
Title
Call for Price for WooCommerce < 4.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Call for Price' Label Settings
Slug
woocommerce-catalog-enquiry
Published
2017-04-20
Title
WooCommerce Catalog Enquiry - Arbitrary File Upload
Slug
woocommerce-catalog-enquiry
Published
2023-11-21
Title
Product Catalog Enquiry for WooCommerce < 5.0.3 - Unauthenticated Stored XSS via Arbitrary Setting Update
Slug
woocommerce-catalog-enquiry
Published
2023-11-03
Title
Product Catalog Enquiry for WooCommerce < 5.0.3 - Unauthenticated Inquiry Saving & Sensitive Information Disclosure
Slug
woocommerce-catalog-enquiry
Published
2024-02-20
Title
Product Catalog Enquiry for WooCommerce by MultiVendorX < 5.0.6 - Cross-Site Request Forgery via REST API
Slug
woocommerce-catalog-enquiry
Published
2026-08-31
Title
CatalogX < 6.1.3 - Unauthenticated Email Content Injection via Shared Transient
Slug
woocommerce-chained-products
Published
2023-01-04
Title
WooCommerce Chained Products < 2.12.0 - Unauthenticated Arbitrary Options Update to 'no'
Slug
woocommerce-check-pincode-zipcode-for-shipping
Published
2025-01-08
Title
Woocommerce check pincode/zipcode for shipping <= 2.0.4 - Cross-Site Request Forgery to Reflected Cross-Site Scripting