WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wc-designer-pro
Published
2025-10-10
Title
WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File Deletion
Slug
wc-designer-pro
Published
2025-10-23
Title
WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File Upload
Slug
wc-designer-pro
Published
2025-10-30
Title
WooCommerce Designer Pro < 1.9.31 - Unauthenticated Arbitrary File Read
Slug
wc-designer-pro
Published
2025-06-10
Title
WooCommerce Designer Pro <= 1.9.24 - Unauthenticated Arbitrary File Upload
Slug
wc-dropi-integration
Published
2025-06-24
Title
Dropify <= 4.6.9 - Reflected Cross-Site Scripting
Slug
wc-dynamic-pricing-and-discounts
Published
2021-08-31
Title
WooCommerce Dynamic Pricing & Discounts < 2.4.2 - Unauthenticated Settings Import to Stored XSS
Slug
wc-dynamic-pricing-and-discounts
Published
2021-08-31
Title
WooCommerce Dynamic Pricing & Discounts < 2.4.2 - Unauthenticated Settings Export
Slug
wc-estimate-and-quote
Published
2025-04-10
Title
WooCommerce Estimate and Quote <= 1.0.2.5 - Reflected Cross-Site Scripting
Slug
wc-fields-factory
Published
2023-03-27
Title
WC Fields Factory < 4.1.7 - ShopManager+ SQLi
Slug
wc-frontend-manager
Published
2021-10-11
Title
WCFM - Frontend Manager for WooCommerce < 6.5.12 - Customer/Subscriber+ SQL Injection
Slug
wc-frontend-manager
Published
2023-04-05
Title
WCFM Frontend Manager < 6.6.0 - Multiple CSRF
Slug
wc-frontend-manager
Published
2023-04-05
Title
WCFM Frontend Manager < 6.6.1 - Subscriber+ Unauthorised AJAX Calls
Slug
wc-frontend-manager
Published
2024-03-25
Title
WCFM – Frontend Manager for WooCommerce < 6.7.9 - Authenticated (Shop manager+) Stored Cross-Site Scripting
Slug
wc-frontend-manager
Published
2024-09-24
Title
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible < 6.7.13 - Insecure Direct Object Reference to Account Takeover/Privilege Escalation
Slug
wc-frontend-manager
Published
2025-07-08
Title
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible < 6.7.17 - Missing Authorization to Unauthenticated Plugin Settings Modification
Slug
wc-frontend-manager
Published
2025-12-15
Title
WCFM – Frontend Manager for WooCommerce < 6.7.25 - Missing Authorization
Slug
wc-frontend-manager
Published
2026-02-09
Title
WCFM - WooCommerce Frontend Manager < 6.7.25 - Authenticated (Shop Manager+) Arbitrary Options Update
Slug
wc-frontend-manager
Published
2026-04-03
Title
WCFM - WooCommerce Frontend Manager < 6.7.26 - Insecure Direct Object References to Autenticated (Vendor+) Arbitrary Post/Product Manipulation
Slug
wc-frontend-manager-ultimate
Published
2026-01-15
Title
WooCommerce Frontend Manager – Ultimate < 6.7.6 - Authenticated (Subscriber+) SQL Injection
Slug
wc-gallery
Published
2023-02-02
Title
Galleries by Angie Makes <= 1.67 - Contributor+ Stored XSS via Shortcode
Slug
wc-gsheetconnector
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
wc-gsheetconnector
Published
2023-06-26
Title
WooCommerce Google Sheet Connector < 1.3.6 - Access Code Update via CSRF
Slug
wc-gsheetconnector
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
wc-gsheetconnector
Published
2024-02-20
Title
WooCommerce Google Sheet Connector < 1.3.12 - Missing Authorization
Slug
wc-gsheetconnector
Published
2025-07-16
Title
WooCommerce Google Sheet Connector < 1.4.0 - Cross-Site Request Forgery