WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wc-frontend-manager
Published
2026-04-03
Title
WCFM - WooCommerce Frontend Manager < 6.7.26 - Insecure Direct Object References to Autenticated (Vendor+) Arbitrary Post/Product Manipulation
Slug
wc-frontend-manager
Published
2026-05-01
Title
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible < 6.7.26 - Authenticated (Vendor+) Insecure Direct Object Reference to Arbitrary User Deletion
Slug
wc-frontend-manager
Published
2026-07-10
Title
WCFM – Frontend Manager for WooCommerce < 6.7.28 - Missing Authorization to Unauthenticated Arbitrary Inquiry Reply Injection via wcfm-my-account-enquiry-manage Controller
Slug
wc-frontend-manager
Published
2026-07-10
Title
WCFM – Frontend Manager for WooCommerce < 6.7.28 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Vendor Data Manipulation via Multiple AJAX Handlers
Slug
wc-frontend-manager-ultimate
Published
2026-01-15
Title
WooCommerce Frontend Manager – Ultimate < 6.7.6 - Authenticated (Subscriber+) SQL Injection
Slug
wc-gallery
Published
2023-02-02
Title
Galleries by Angie Makes <= 1.67 - Contributor+ Stored XSS via Shortcode
Slug
wc-gsheetconnector
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
wc-gsheetconnector
Published
2023-06-26
Title
WooCommerce Google Sheet Connector < 1.3.6 - Access Code Update via CSRF
Slug
wc-gsheetconnector
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
wc-gsheetconnector
Published
2024-02-20
Title
WooCommerce Google Sheet Connector < 1.3.12 - Missing Authorization
Slug
wc-gsheetconnector
Published
2025-07-16
Title
WooCommerce Google Sheet Connector < 1.4.0 - Cross-Site Request Forgery
Slug
wc-hkdigital-acba-gateway
Published
2026-04-30
Title
Freemius < 2.11.0 - Reflected DOM-Based XSS via url Parameter
Slug
wc-j-upsellator
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
wc-ja-ja-pagamentos-multicaixa-express
Published
2025-03-17
Title
Já-Já Pagamentos for WooCommerce <= 1.3.0 - Reflected Cross-Site Scripting
Slug
wc-multi-currency
Published
2023-12-06
Title
Multi Currency For WooCommerce < 1.5.6 - Cross-Site Request Forgery
Slug
wc-multi-currency
Published
2024-04-15
Title
Multi Currency For WooCommerce < 1.5.6 - Missing Authorization
Slug
wc-multishipping
Published
2023-11-21
Title
WCMultiShipping < 2.3.6 - Missing Authorization to Log Export
Slug
wc-multishipping
Published
2023-11-28
Title
WCMultiShipping < 2.3.8 - Subscriber+ Arbitrary Account Credentials Test
Slug
wc-multishipping
Published
2026-06-10
Title
WCMultiShipping — Mondial Relay, Inpost & Chronopost for WooCommerce < 3.0.3 - Authenticated (Subscriber+) SQL Injection
Slug
wc-multivendor-marketplace
Published
2021-11-22
Title
WCFM - WooCommerce Multivendor Marketplace < 3.4.12 - Unauthenticated SQL Injection
Slug
wc-multivendor-marketplace
Published
2023-04-05
Title
WCFM Marketplace < 3.4.12 - Subscriber+ Unauthorised AJAX Calls
Slug
wc-multivendor-marketplace
Published
2023-04-05
Title
WCFM Marketplace < 3.5.0 - Multiple CSRF
Slug
wc-multivendor-marketplace
Published
2023-11-23
Title
WCFM Marketplace < 3.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Slug
wc-multivendor-marketplace
Published
2024-09-16
Title
WCFM Marketplace – Multivendor Marketplace for WooCommerce < 3.6.12 - Reflected Cross-Site Scripting
Slug
wc-multivendor-marketplace
Published
2025-12-15
Title
WCFM Marketplace < 3.7.4 - Missing Authorization