WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wc-frontend-manager
Published
2021-10-11
Title
WCFM - Frontend Manager for WooCommerce < 6.5.12 - Customer/Subscriber+ SQL Injection
Slug
wc-frontend-manager
Published
2023-04-05
Title
WCFM Frontend Manager < 6.6.0 - Multiple CSRF
Slug
wc-frontend-manager
Published
2023-04-05
Title
WCFM Frontend Manager < 6.6.1 - Subscriber+ Unauthorised AJAX Calls
Slug
wc-frontend-manager
Published
2024-03-25
Title
WCFM – Frontend Manager for WooCommerce < 6.7.9 - Authenticated (Shop manager+) Stored Cross-Site Scripting
Slug
wc-frontend-manager
Published
2024-09-24
Title
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible < 6.7.13 - Insecure Direct Object Reference to Account Takeover/Privilege Escalation
Slug
wc-frontend-manager
Published
2025-07-08
Title
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible < 6.7.17 - Missing Authorization to Unauthenticated Plugin Settings Modification
Slug
wc-frontend-manager
Published
2025-12-15
Title
WCFM – Frontend Manager for WooCommerce <= 6.7.21 - Missing Authorization
Slug
wc-gallery
Published
2023-02-02
Title
Galleries by Angie Makes <= 1.67 - Contributor+ Stored XSS via Shortcode
Slug
wc-gsheetconnector
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
wc-gsheetconnector
Published
2023-06-26
Title
WooCommerce Google Sheet Connector < 1.3.6 - Access Code Update via CSRF
Slug
wc-gsheetconnector
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
wc-gsheetconnector
Published
2024-02-20
Title
WooCommerce Google Sheet Connector < 1.3.12 - Missing Authorization
Slug
wc-gsheetconnector
Published
2025-07-16
Title
WooCommerce Google Sheet Connector < 1.4.0 - Cross-Site Request Forgery
Slug
wc-j-upsellator
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
wc-ja-ja-pagamentos-multicaixa-express
Published
2025-03-17
Title
Já-Já Pagamentos for WooCommerce <= 1.3.0 - Reflected Cross-Site Scripting
Slug
wc-multi-currency
Published
2023-12-06
Title
Multi Currency For WooCommerce < 1.5.6 - Cross-Site Request Forgery
Slug
wc-multi-currency
Published
2024-04-15
Title
Multi Currency For WooCommerce < 1.5.6 - Missing Authorization
Slug
wc-multishipping
Published
2023-11-21
Title
WCMultiShipping < 2.3.6 - Missing Authorization to Log Export
Slug
wc-multishipping
Published
2023-11-28
Title
WCMultiShipping < 2.3.8 - Subscriber+ Arbitrary Account Credentials Test
Slug
wc-multivendor-marketplace
Published
2021-11-22
Title
WCFM - WooCommerce Multivendor Marketplace < 3.4.12 - Unauthenticated SQL Injection
Slug
wc-multivendor-marketplace
Published
2023-04-05
Title
WCFM Marketplace < 3.4.12 - Subscriber+ Unauthorised AJAX Calls
Slug
wc-multivendor-marketplace
Published
2023-04-05
Title
WCFM Marketplace < 3.5.0 - Multiple CSRF
Slug
wc-multivendor-marketplace
Published
2023-11-23
Title
WCFM Marketplace < 3.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Slug
wc-multivendor-marketplace
Published
2024-09-16
Title
WCFM Marketplace – Multivendor Marketplace for WooCommerce < 3.6.12 - Reflected Cross-Site Scripting
Slug
wc-multivendor-marketplace
Published
2025-12-15
Title
WCFM Marketplace <= 3.6.17 - Missing Authorization