WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
woo-wallet
Published
2022-10-30
Title
TeraWallet – For WooCommerce < 1.4.0 - Settings Update via CSRF
Slug
woo-wallet
Published
2024-03-07
Title
TeraWallet – Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds < 1.4.11 - Missing Authorization to Authenticated (Subscriber+) User Email Export
Slug
woo-wallet
Published
2024-04-24
Title
TeraWallet – Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds < 1.5.1 - Authenticated (Shop Manager+) Stored Cross-Site Scripting
Slug
woo-wallet
Published
2024-07-11
Title
Wallet for WooCommerce < 1.5.5 - Authenticated (Subscriber+) SQL Injection via 'search[value]'
Slug
woo-wallet
Published
2024-11-27
Title
Wallet for WooCommerce < 1.5.7 - Subscriber+ Funds Creation
Slug
woo-wallet
Published
2026-02-20
Title
TeraWallet – For WooCommerce < 1.5.16 - Authenticated (Customer+) Race Condition
Slug
woo-wallet
Published
2026-07-10
Title
Wallet for WooCommerce < 1.6.5 - Missing Authorization to Authenticated (Subscriber+) User/Email Enumeration via terawallet_export_user_search AJAX Action
Slug
woo-wallet
Published
2026-08-10
Title
TeraWallet - Wallet for WooCommerce < 1.6.10 - Subscriber+ Wallet Balance Inflation via Discounted Top-Up
Slug
woo-whatsapp-request-quote
Published
2021-08-09
Title
Titan Framework <= 1.12.1 - Reflected Cross-Site Scripting (XSS)
Slug
woo-wholesale-pricing
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
woo-wholesale-pricing
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
woo-wholesale-pricing
Published
2026-07-28
Title
Wholesale for WooCommerce < 2.0.6 - Authenticated (Author+) Privilege Escalation via 'user_role_set' Parameter
Slug
woo-xendit-virtual-accounts
Published
2026-02-03
Title
Xendit Payment < 6.1.0 - Missing Authorization to Unauthenticated Arbitrary Order Status Update to Paid
Slug
woo-xendit-virtual-accounts
Published
2026-07-27
Title
Xendit Payment < 7.2.1 - Missing Authorization
Slug
woo-zoho
Published
2021-08-26
Title
Multiple Plugins from CRM Perks - Reflected Cross-Site Scripting
Slug
wooCommerce-order-proposal
Published
2024-10-22
Title
WooCommerce Order Proposal < 2.0.6 - Authenticated (Shop Manager+) Privilege Escalation via Order Proposal
Slug
woobox
Published
2025-05-07
Title
Woobox < 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
woobox
Published
2025-05-07
Title
Woobox < 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
woocommerce
Published
2014-08-01
Title
WooCommerce 2.0.17 - hide-wc-extensions-message Parameter Reflected XSS
Slug
woocommerce
Published
2014-08-01
Title
WooCommerce 2.0.12 - index.php calc_shipping_state Parameter XSS
Slug
woocommerce
Published
2014-09-21
Title
WooCommerce < 2.2.3 - Reflected Cross-Site Scripting (XSS)
Slug
woocommerce
Published
2014-09-17
Title
WooCommerce <= 2.2.2 - Reflected Cross-Site Scripting (XSS)
Slug
woocommerce
Published
2015-02-22
Title
WooCommerce <= 2.2.10 - Cross-Site Scripting (XSS)
Slug
woocommerce
Published
2015-03-13
Title
WooCommerce 2.3 - 2.3.5 - SQL Injection
Slug
woocommerce
Published
2015-06-10
Title
WooCommerce 2.0.20-2.3.10 - Object Injection / XXE