WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wc-vendors
Published
2026-06-18
Title
WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors < 2.6.9 - Authenticated (Subscriber+) SQL Injection
Slug
wc-vendors
Published
2026-08-15
Title
WC Vendors < 2.7.1 - Authenticated (Shop Manager+) SQL Injection via 'status' Parameter
Slug
wc-vendors
Published
2026-08-31
Title
WC Vendors < 2.7.2.1 - Order Shipment Status Change via CSRF
Slug
wc-vendors
Published
2026-08-31
Title
WC Vendors < 2.7.2.1 - Vendor+ Cross-Vendor Product and Arbitrary Post Modification via IDOR
Slug
wc-vendors
Published
2026-08-31
Title
WC Vendors < 2.7.2.1 - Vendor+ Cross-Vendor Order Shipment Status Change
Slug
wc-venipak-shipping
Published
2024-03-25
Title
Shipping with Venipak for WooCommerce < 1.19.6 - Reflected Cross-Site Scripting via 'venipak_labels_link'
Slug
wc-wallet
Published
2025-01-16
Title
WC Wallet <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion
Slug
wc-zelle
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
wc-zelle
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
wc1c-main
Published
2025-01-06
Title
WC1C <= 0.23.0 - Reflected Cross-Site Scripting
Slug
wc4bp
Published
2019-02-26
Title
Freemius Library < 2.2.4 - Subscriber+ Arbitrary Option Update
Slug
wc4bp
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
wc4bp
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
wc4bp
Published
2024-03-22
Title
BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages < 3.4.21 - Authenticated (Subscriber+) PHP Object Injection in get_simple_request
Slug
wc4bp
Published
2024-06-06
Title
BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages < 3.4.20 - Missing Authorization
Slug
wc4bp
Published
2025-02-28
Title
BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages < 3.4.25 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update
Slug
wc4bp
Published
2025-02-28
Title
BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages < 3.4.26 - Cross-Site Request Forgery to Limited Settings Update
Slug
wc4bp-groups
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
wcboost-products-compare
Published
2026-06-26
Title
WCBoost – Products Compare < 1.1.1 - Unauthenticated Sensitive Information Exposure
Slug
wcc-seo-keyword-research
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
wcc-seo-keyword-research
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
wccp-pro
Published
2024-05-29
Title
WP Content Copy Protection & No Right Click (premium) < 15.3 - Open Redirect
Slug
wccp-pro
Published
2024-05-29
Title
WP Content Copy Protection & No Right Click (premium) <= 15.0 - Admin+ Stored XSS
Slug
wcfm-marketplace-rest-api
Published
2023-04-26
Title
WooCommerce Multivendor Marketplace – REST API < 1.6.0 - Subscriber+ Arbitrary Orders Item And Notes Update
Slug
wcfm-marketplace-rest-api
Published
2025-03-21
Title
WooCommerce Multivendor Marketplace – REST API < 1.6.3 - Authenticated (Subscriber+) SQL Injection