WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wc-frontend-manager
Published
2021-10-11
Title
WCFM - Frontend Manager for WooCommerce < 6.5.12 - Customer/Subscriber+ SQL Injection
Slug
wc-frontend-manager
Published
2023-04-05
Title
WCFM Frontend Manager < 6.6.0 - Multiple CSRF
Slug
wc-frontend-manager
Published
2023-04-05
Title
WCFM Frontend Manager < 6.6.1 - Subscriber+ Unauthorised AJAX Calls
Slug
wc-frontend-manager
Published
2024-03-25
Title
WCFM – Frontend Manager for WooCommerce < 6.7.9 - Authenticated (Shop manager+) Stored Cross-Site Scripting
Slug
wc-frontend-manager
Published
2024-09-24
Title
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible < 6.7.13 - Insecure Direct Object Reference to Account Takeover/Privilege Escalation
Slug
wc-frontend-manager
Published
2025-07-08
Title
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible < 6.7.17 - Missing Authorization to Unauthenticated Plugin Settings Modification
Slug
wc-frontend-manager
Published
2025-12-15
Title
WCFM – Frontend Manager for WooCommerce < 6.7.25 - Missing Authorization
Slug
wc-frontend-manager
Published
2026-02-09
Title
WCFM - WooCommerce Frontend Manager < 6.7.25 - Authenticated (Shop Manager+) Arbitrary Options Update
Slug
wc-frontend-manager
Published
2026-04-03
Title
WCFM - WooCommerce Frontend Manager < 6.7.26 - Insecure Direct Object References to Autenticated (Vendor+) Arbitrary Post/Product Manipulation
Slug
wc-frontend-manager
Published
2026-05-01
Title
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible < 6.7.26 - Authenticated (Vendor+) Insecure Direct Object Reference to Arbitrary User Deletion
Slug
wc-frontend-manager
Published
2026-07-10
Title
WCFM – Frontend Manager for WooCommerce < 6.7.28 - Missing Authorization to Unauthenticated Arbitrary Inquiry Reply Injection via wcfm-my-account-enquiry-manage Controller
Slug
wc-frontend-manager
Published
2026-07-10
Title
WCFM – Frontend Manager for WooCommerce < 6.7.28 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Vendor Data Manipulation via Multiple AJAX Handlers
Slug
wc-frontend-manager-ultimate
Published
2026-01-15
Title
WooCommerce Frontend Manager – Ultimate < 6.7.6 - Authenticated (Subscriber+) SQL Injection
Slug
wc-gallery
Published
2023-02-02
Title
Galleries by Angie Makes <= 1.67 - Contributor+ Stored XSS via Shortcode
Slug
wc-gsheetconnector
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
wc-gsheetconnector
Published
2023-06-26
Title
WooCommerce Google Sheet Connector < 1.3.6 - Access Code Update via CSRF
Slug
wc-gsheetconnector
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
wc-gsheetconnector
Published
2024-02-20
Title
WooCommerce Google Sheet Connector < 1.3.12 - Missing Authorization
Slug
wc-gsheetconnector
Published
2025-07-16
Title
WooCommerce Google Sheet Connector < 1.4.0 - Cross-Site Request Forgery
Slug
wc-hkdigital-acba-gateway
Published
2026-04-30
Title
Freemius < 2.11.0 - Reflected DOM-Based XSS via url Parameter
Slug
wc-j-upsellator
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
wc-ja-ja-pagamentos-multicaixa-express
Published
2025-03-17
Title
Já-Já Pagamentos for WooCommerce <= 1.3.0 - Reflected Cross-Site Scripting
Slug
wc-multi-currency
Published
2023-12-06
Title
Multi Currency For WooCommerce < 1.5.6 - Cross-Site Request Forgery
Slug
wc-multi-currency
Published
2024-04-15
Title
Multi Currency For WooCommerce < 1.5.6 - Missing Authorization
Slug
wc-multishipping
Published
2023-11-21
Title
WCMultiShipping < 2.3.6 - Missing Authorization to Log Export