WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
woo-giftcards
Published
2025-04-01
Title
Gift Cards for WooCommerce <= 1.5.8 - Missing Authorization
Slug
woo-gutenberg-products-block
Published
2020-11-06
Title
WooCommerce Blocks < 3.7.1 - Guest Account Creation
Slug
woo-gutenberg-products-block
Published
2021-07-15
Title
WooCommerce Blocks 2.5 to 5.5 - Unauthenticated SQL Injection
Slug
woo-gutenberg-products-block
Published
2023-11-15
Title
WooCommerce <= 8.1.1 & WooCommerce Blocks <= 11.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Featured Image alt Attribute
Slug
woo-inpost
Published
2024-08-16
Title
InPost for WooCommerce <= 1.4.0 and InPost PL <= 1.4.4 - Missing Authorization to Unauthenticated Arbitrary File Read and Delete
Slug
woo-inquiry
Published
2024-08-20
Title
Woo Inquiry <= 0.1 - Unauthenticated SQL Injection
Slug
woo-line-notify
Published
2025-06-18
Title
Woocommerce Line Notify <= 1.1.7 - Reflected Cross-Site Scripting
Slug
woo-login-redirect
Published
2023-10-03
Title
WooCommerce Login Redirect <= 2.2.4 - CSRF
Slug
woo-login-redirect
Published
2023-11-28
Title
WooCommerce Login Redirect <= 2.2.4 - Cross-Site Request Forgery
Slug
woo-lucky-wheel
Published
2025-12-29
Title
Lucky Wheel for WooCommerce – Spin a Sale < 1.1.14 - Authenticated (Administrator+) PHP Code Injection via Conditional Tags
Slug
woo-mailerlite
Published
2024-01-08
Title
MailerLite – WooCommerce integration < 2.0.9 - Cross-Site Request Forgery via Multiple AJAX Functions
Slug
woo-mailerlite
Published
2024-01-08
Title
MailerLite – WooCommerce integration < 2.0.9 - Missing Authorization via Multiple Functions
Slug
woo-mailerlite
Published
2025-12-15
Title
MailerLite - WooCommerce integration < 3.1.4 - Missing Authorization to Data Deletion
Slug
woo-mailerlite
Published
2026-01-20
Title
MailerLite – WooCommerce integration < 3.1.3 - Unauthenticated SQL Injection
Slug
woo-manage-fraud-orders
Published
2024-10-15
Title
Woo Manage Fraud Orders <= 2.6.1 - Reflected Cross-Site Scripting
Slug
woo-manage-fraud-orders
Published
2024-10-30
Title
Woo Manage Fraud Orders <= 2.6.1 - Unauthenticated Information Exposure via Log Files
Slug
woo-merchantx
Published
2021-07-05
Title
Woo MerchantX <= 1.0 - CSRF Bypass
Slug
woo-min-max-quantity-step-control-single
Published
2023-08-21
Title
Min Max Control < 4.6 - Reflected XSS
Slug
woo-moneybird
Published
2021-09-09
Title
Integration of Moneybird for WooCommerce <= 2.1.1 - Reflected Cross-Site Scripting
Slug
woo-mstoreapp-mobile-app
Published
2025-10-31
Title
Mstoreapp Mobile (App <= 2.08, Multivendor <= 9.0.1) - Unauthenticated Privilege Escalation
Slug
woo-multi-currency
Published
2022-05-31
Title
CURCY < 2.1.18 - Reflected Cross-Site Scripting
Slug
woo-multi-currency
Published
2024-10-15
Title
CURCY < 2.2.4 - Reflected Cross-Site Scripting
Slug
woo-multi-currency
Published
2025-02-05
Title
CURCY – Multi Currency for WooCommerce < 2.2.6 - Unauthenticated Arbitrary Shortcode Execution via get_products_price Function
Slug
woo-myghpay-payment-gateway
Published
2021-12-14
Title
WooCommerce myghpay Payment Gateway <= 3.0 - Reflected Cross-Site Scripting
Slug
woo-nmi-three-step
Published
2021-07-05
Title
NMI Gateway For WooCommerce <= 1.6.11 - CSRF Bypass