WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
woo-floating-cart-lite
Published
2026-04-30
Title
Freemius < 2.11.0 - Reflected DOM-Based XSS via url Parameter
Slug
woo-gerencianet-official
Published
2025-12-31
Title
Gerencianet Oficial <= 3.1.3 - Unauthenticated Information Exposure
Slug
woo-gift-cards-lite
Published
2021-06-08
Title
CSRF Bypass in Multiple Plugins
Slug
woo-gift-cards-lite
Published
2021-06-21
Title
Ultimate Gift Cards for WooCommerce < 2.1.2 - Cross-Site Request Forgery
Slug
woo-gift-cards-lite
Published
2024-03-15
Title
Ultimate Gift Cards for WooCommerce – Create, Redeem & Manage Digital Gift Certificates with Personalized Templates < 2.6.7 - Missing Authorization to Unauthenticated Information Exposure
Slug
woo-gift-cards-lite
Published
2025-01-07
Title
Ultimate Gift Cards for WooCommerce <= 3.0.6 - Missing Authorization to Infinite Money Glitch
Slug
woo-gift-cards-lite
Published
2025-06-02
Title
Ultimate Gift Cards for WooCommerce < 3.1.5 - Authenticated (Administrator+) SQL Injection via wps_wgm_save_post Function
Slug
woo-gift-cards-lite
Published
2026-01-08
Title
Ultimate Gift Cards for WooCommerce < 3.2.5 - Missing Authorization
Slug
woo-gift-cards-lite
Published
2026-09-02
Title
Ultimate Gift Cards for WooCommerce < 3.2.10 - Missing Authorization
Slug
woo-gift-cards-lite
Published
2026-09-07
Title
Ultimate Gift Cards for WooCommerce < 3.2.10 - Subscriber+ Gift Card Theft and Destruction via Unauthorized Redemption
Slug
woo-gift-cards-lite
Published
2026-09-08
Title
Ultimate Gift Cards For WooCommerce < 3.2.10 - Unauthenticated Gift Card Value Inflation via Discounted Purchase
Slug
woo-gift-cards-lite
Published
2026-09-08
Title
Ultimate Gift Cards for WooCommerce 3.0.3 - 3.2.9 - Unauthenticated Gift Card Code and Customer PII Disclosure via wps_uwgc_report_details
Slug
woo-gift-product
Published
2025-09-05
Title
Woocommerce Gifts Product <= 1.0.0 - Cross-Site Request Forgery
Slug
woo-giftcards
Published
2025-04-01
Title
Gift Cards for WooCommerce <= 1.5.8 - Missing Authorization
Slug
woo-gutenberg-products-block
Published
2020-11-06
Title
WooCommerce Blocks < 3.7.1 - Guest Account Creation
Slug
woo-gutenberg-products-block
Published
2021-07-15
Title
WooCommerce Blocks 2.5 to 5.5 - Unauthenticated SQL Injection
Slug
woo-gutenberg-products-block
Published
2023-11-15
Title
WooCommerce <= 8.1.1 & WooCommerce Blocks <= 11.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Featured Image alt Attribute
Slug
woo-idpay-gateway
Published
2026-04-06
Title
IDPay Payment Gateway for Woocommerce <= 2.2.5 - Unauthenticated Information Exposure
Slug
woo-inpost
Published
2024-08-16
Title
InPost for WooCommerce <= 1.4.0 and InPost PL <= 1.4.4 - Missing Authorization to Unauthenticated Arbitrary File Read and Delete
Slug
woo-inquiry
Published
2024-08-20
Title
Woo Inquiry <= 0.1 - Unauthenticated SQL Injection
Slug
woo-jtl-connector
Published
2026-06-01
Title
JTL-Connector for WooCommerce < 2.4.2 - Missing Authorization to Authenticated (Subscriber+) Settings Modification via Multiple Functions
Slug
woo-jtl-connector
Published
2026-10-13
Title
JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated Arbitrary File Upload via 'image.push' Method
Slug
woo-jtl-connector
Published
2026-10-13
Title
JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated SQL Injection
Slug
woo-line-notify
Published
2025-06-18
Title
Woocommerce Line Notify <= 1.1.7 - Reflected Cross-Site Scripting
Slug
woo-login-redirect
Published
2023-10-03
Title
WooCommerce Login Redirect <= 2.2.4 - CSRF