WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wc-dynamic-pricing-and-discounts
Published
2021-08-31
Title
WooCommerce Dynamic Pricing & Discounts < 2.4.2 - Unauthenticated Settings Export
Slug
wc-estimate-and-quote
Published
2025-04-10
Title
WooCommerce Estimate and Quote <= 1.0.2.5 - Reflected Cross-Site Scripting
Slug
wc-fields-factory
Published
2023-03-27
Title
WC Fields Factory < 4.1.7 - ShopManager+ SQLi
Slug
wc-frontend-manager
Published
2021-10-11
Title
WCFM - Frontend Manager for WooCommerce < 6.5.12 - Customer/Subscriber+ SQL Injection
Slug
wc-frontend-manager
Published
2023-04-05
Title
WCFM Frontend Manager < 6.6.0 - Multiple CSRF
Slug
wc-frontend-manager
Published
2023-04-05
Title
WCFM Frontend Manager < 6.6.1 - Subscriber+ Unauthorised AJAX Calls
Slug
wc-frontend-manager
Published
2024-03-25
Title
WCFM – Frontend Manager for WooCommerce < 6.7.9 - Authenticated (Shop manager+) Stored Cross-Site Scripting
Slug
wc-frontend-manager
Published
2024-09-24
Title
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible < 6.7.13 - Insecure Direct Object Reference to Account Takeover/Privilege Escalation
Slug
wc-frontend-manager
Published
2025-07-08
Title
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible < 6.7.17 - Missing Authorization to Unauthenticated Plugin Settings Modification
Slug
wc-frontend-manager
Published
2025-12-15
Title
WCFM – Frontend Manager for WooCommerce < 6.7.25 - Missing Authorization
Slug
wc-frontend-manager
Published
2026-02-09
Title
WCFM - WooCommerce Frontend Manager < 6.7.25 - Authenticated (Shop Manager+) Arbitrary Options Update
Slug
wc-frontend-manager-ultimate
Published
2026-01-15
Title
WooCommerce Frontend Manager – Ultimate < 6.7.6 - Authenticated (Subscriber+) SQL Injection
Slug
wc-gallery
Published
2023-02-02
Title
Galleries by Angie Makes <= 1.67 - Contributor+ Stored XSS via Shortcode
Slug
wc-gsheetconnector
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
wc-gsheetconnector
Published
2023-06-26
Title
WooCommerce Google Sheet Connector < 1.3.6 - Access Code Update via CSRF
Slug
wc-gsheetconnector
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
wc-gsheetconnector
Published
2024-02-20
Title
WooCommerce Google Sheet Connector < 1.3.12 - Missing Authorization
Slug
wc-gsheetconnector
Published
2025-07-16
Title
WooCommerce Google Sheet Connector < 1.4.0 - Cross-Site Request Forgery
Slug
wc-j-upsellator
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
wc-ja-ja-pagamentos-multicaixa-express
Published
2025-03-17
Title
Já-Já Pagamentos for WooCommerce <= 1.3.0 - Reflected Cross-Site Scripting
Slug
wc-multi-currency
Published
2023-12-06
Title
Multi Currency For WooCommerce < 1.5.6 - Cross-Site Request Forgery
Slug
wc-multi-currency
Published
2024-04-15
Title
Multi Currency For WooCommerce < 1.5.6 - Missing Authorization
Slug
wc-multishipping
Published
2023-11-21
Title
WCMultiShipping < 2.3.6 - Missing Authorization to Log Export
Slug
wc-multishipping
Published
2023-11-28
Title
WCMultiShipping < 2.3.8 - Subscriber+ Arbitrary Account Credentials Test
Slug
wc-multivendor-marketplace
Published
2021-11-22
Title
WCFM - WooCommerce Multivendor Marketplace < 3.4.12 - Unauthenticated SQL Injection