WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
woo-redsys-gateway-light
Published
2026-04-15
Title
Payment Gateway for Redsys & WooCommerce Lite < 7.0.1 - Improper Verification of Cryptographic Signature to Unauthenticated Payment Status Manipulation
Slug
woo-refund-and-exchange-lite
Published
2022-12-05
Title
Return Refund and Exchange For WooCommerce < 4.0.9 - Unauthenticated Arbitrary File Upload
Slug
woo-refund-and-exchange-lite
Published
2025-02-13
Title
Return Refund and Exchange For WooCommerce < 4.4.6 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
Slug
woo-refund-and-exchange-lite
Published
2025-02-13
Title
Return Refund and Exchange For WooCommerce < 4.4.6 - Subscriber+ IDOR
Slug
woo-refund-and-exchange-lite
Published
2025-11-20
Title
Return Refund and Exchange For WooCommerce < 4.5.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Refund Request Cancellation
Slug
woo-refund-and-exchange-lite
Published
2025-11-20
Title
Return Refund and Exchange For WooCommerce < 4.5.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Order Message Read
Slug
woo-related-products-refresh-on-reload
Published
2023-10-29
Title
Related Products for WooCommerce < 3.3.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Slug
woo-remove-cart-and-query-button
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
woo-remove-cart-and-query-button
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
woo-reviews-by-wiremo
Published
2025-12-31
Title
Wiremo <= 1.4.99 - Missing Authorization
Slug
woo-rfq-for-woocommerce
Published
2025-03-19
Title
NP Quote Request for WooCommerce < 1.9.180 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure
Slug
woo-salesforce-plugin-crm-perks
Published
2021-08-26
Title
Multiple Plugins from CRM Perks - Reflected Cross-Site Scripting
Slug
woo-salesforce-plugin-crm-perks
Published
2025-05-07
Title
Integration for WooCommerce and Salesforce < 1.7.6 - Open Redirect
Slug
woo-save-abandoned-carts
Published
2024-09-30
Title
CartBounty – Save and recover abandoned carts for WooCommerce < 8.2.1 - Cross-Site Request Forgery
Slug
woo-seo-addon
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
woo-seo-addon
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
woo-seo-content-randomizer-addon
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
woo-shipping-display-mode
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
woo-shipping-display-mode
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
woo-shipping-dpd-baltic
Published
2022-11-16
Title
WooCommerce Shipping - DPD baltic < 1.2.11 - Admin+ Stored XSS
Slug
woo-shipping-dpd-baltic
Published
2022-11-21
Title
WooCommerce Shipping - DPD baltic < 1.2.57 - Subscriber+ Arbitrary Options Deletion
Slug
woo-shipping-dpd-baltic
Published
2024-10-17
Title
DPD Baltic Shipping < 1.2.84 - Reflected Cross-Site Scripting
Slug
woo-show-single-variations-shop-category
Published
2025-11-28
Title
Show Variations as Single Products Woocommerce < 3.0 - Missing Authorization
Slug
woo-simple-frontend-manager
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
woo-simple-frontend-manager
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting