WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
woo-mailerlite
Published
2026-01-20
Title
MailerLite – WooCommerce integration < 3.1.3 - Unauthenticated SQL Injection
Slug
woo-manage-fraud-orders
Published
2024-10-15
Title
Woo Manage Fraud Orders <= 2.6.1 - Reflected Cross-Site Scripting
Slug
woo-manage-fraud-orders
Published
2024-10-30
Title
Woo Manage Fraud Orders <= 2.6.1 - Unauthenticated Information Exposure via Log Files
Slug
woo-merchantx
Published
2021-07-05
Title
Woo MerchantX <= 1.0 - CSRF Bypass
Slug
woo-min-max-quantity-step-control-single
Published
2023-08-21
Title
Min Max Control < 4.6 - Reflected XSS
Slug
woo-moneybird
Published
2021-09-09
Title
Integration of Moneybird for WooCommerce <= 2.1.1 - Reflected Cross-Site Scripting
Slug
woo-mstoreapp-mobile-app
Published
2025-10-31
Title
Mstoreapp Mobile (App <= 2.08, Multivendor <= 9.0.1) - Unauthenticated Privilege Escalation
Slug
woo-multi-currency
Published
2022-05-31
Title
CURCY < 2.1.18 - Reflected Cross-Site Scripting
Slug
woo-multi-currency
Published
2024-10-15
Title
CURCY < 2.2.4 - Reflected Cross-Site Scripting
Slug
woo-multi-currency
Published
2025-02-05
Title
CURCY – Multi Currency for WooCommerce < 2.2.6 - Unauthenticated Arbitrary Shortcode Execution via get_products_price Function
Slug
woo-multi-currency
Published
2026-07-02
Title
CURCY < 2.2.15 - Unauthenticated Arbitrary Shortcode Execution via 'exchange' Parameter
Slug
woo-myghpay-payment-gateway
Published
2021-12-14
Title
WooCommerce myghpay Payment Gateway <= 3.0 - Reflected Cross-Site Scripting
Slug
woo-nmi-three-step
Published
2021-07-05
Title
NMI Gateway For WooCommerce <= 1.6.11 - CSRF Bypass
Slug
woo-nmi-three-step
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
woo-nmi-three-step
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
woo-one-click-upsell-funnel
Published
2024-12-20
Title
One Click Upsell Funnel for WooCommerce < 3.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via wps_wocuf_pro_yes Shortcode
Slug
woo-order-export-lite
Published
2018-06-20
Title
Advanced Order Export For WooCommerce <= 1.5.4 - CSV Injection
Slug
woo-order-export-lite
Published
2020-05-04
Title
Advanced Order Export For WooCommerce < 3.1.4 - Authenticated Cross-Site Scripting (XSS)
Slug
woo-order-export-lite
Published
2021-03-03
Title
Advanced Order Export For WooCommerce < 3.1.8 - Authenticated Reflected Cross-Site Scripting (XSS)
Slug
woo-order-export-lite
Published
2022-08-25
Title
Advanced Order Export For WooCommerce < 3.3.2 - Reflected Cross-Site Scripting
Slug
woo-order-export-lite
Published
2022-10-20
Title
Advanced Order Export For WooCommerce < 3.3.3 - Export Files via CSRF
Slug
woo-order-export-lite
Published
2024-04-05
Title
Advanced Order Export For WooCommerce < 3.4.5 - Shop Manager+ Remote Code Execution
Slug
woo-order-export-lite
Published
2024-11-12
Title
Advanced Order Export For WooCommerce < 3.5.6 - Unauthenticated PHP Object Injection via Order Details
Slug
woo-order-export-lite
Published
2026-06-17
Title
Advanced Order Export For WooCommerce < 4.1.0 - Authenticated (Shop Manager+) SQL Injection via 'sort_direction' Parameter
Slug
woo-order-export-lite
Published
2026-06-24
Title
Advanced Order Export For WooCommerce < 4.0.10 - Authenticated (Customer+) Stored Cross-Site Scripting