CVE-2024-54262

CVE-2024-54262 Import Export For WooCommerce = 1.5 - Subida Arbitraria de Archivos Autenticada Suscriptor+ Descripción El plugin Import Export For WooCommerce para WordPress es vulnerable a subidas arbitrarias de archivos debido a la falta de validación del tipo de archivo en todas las versiones...

CVE-2025-1661

CVE-2025-1661 - Unauthenticated Local File Inclusion LFI in HUSKY – Products Filter Professional for WooCommerce Description The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion LFI in all versions up to and including 1.3.6.5 via the...

CVE-2025-22352

1️⃣ Component type WordPress plugin 2️⃣ Component details Component name ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes Vulnerable version = 1.4.8 Component slug elex-bulk-edit-products-prices-attributes-for-woocommerce-basic Component link...

WordPress OrderConvo < 14 - Path Traversal

WooCommerce OrderConvo WordPress plugin \u003C 14 contains a path traversal vulnerability caused by improper validation of file download paths, letting unauthenticated attackers read or download arbitrary files remotely id: CVE-2025-10162 info: name: WordPress OrderConvo 14 - Path Traversal autho...

Hippoo Mobile App for WooCommerce <= 1.9.4 - Authentication Bypass to Admin Account Takeover

Hippoo Mobile App for WooCommerce WordPress plugin = 1.9.4 contains an authentication bypass caused by logic conflation in user permission checks, letting unauthenticated attackers take over administrator accounts via REST API password reset. id: CVE-2026-10580 info: name: Hippoo Mobile App for...

WCAPF WooCommerce Ajax Product Filter - SQL Injection

WCAPF WooCommerce Ajax Product Filter = 4.2.3 contains a time-based SQL injection caused by insufficient escaping of the 'post-author' parameter, letting unauthenticated attackers extract sensitive database information remotely. id: CVE-2026-3396 info: name: WCAPF WooCommerce Ajax Product Filter ...

Custom Product Tabs for WooCommerce < 1.7.8 - Unauthenticated Toggle Content Setting Update

YIKES Inc. Custom Product Tabs for WooCommerce plugin \u003C= 1.7.7 contains a broken access control caused by improper permission checks in &yikes-the-content-toggle option update, letting attackers modify content without authorization. id: CVE-2022-28666 info: name: Custom Product Tabs for...

CVE-2025-2907

CVE-2025-2907 Exploit Details Published : 2025-04-04 Updated : 2025-03-28 Severity : Critical CVSS Score: 9.8 CWE : CWE-862: CWE-862 Missing Authorization Affected Versions : All versions from n/a through 12.3.1 Researcher :...

CVE-2025-4602

eMagicOne Store Manager para WooCommerce = 1.2.5 - Lectura Arbitraria de Archivos No Autenticada El plugin Administrador de Tienda eMagicOne para WooCommerce expone un punto final de protocolo de gestión remota ?connector=bridge que permite operaciones de eliminación de archivos en el servidor. E...

WooRefer

WooRefer | CVE-2022-4047 - Return Refund and Exchange For WooCommerce Automatic Mass Tool for check and exploiting vulnerability in CVE-2022-4047 - Return Refund and Exchange For WooCommerce install.sh sha1sum install.sh | grep 12345678 md5sum install.sh sha512sum install.sh bash install.sh How T...

CVE-2025-15260

CVE-2025-15260: Missing Authorization / Broken Access Control in Plugin - MyRewards – Loyalty Points and Rewards for WooCommerce Disclaimer: This repository is created for educational purposes and ethical disclosure only. The vulnerability has been responsibly reported to the vendor and patched. ...

hdwebmobile-photo-video-reviews

HDWebmobile Photo & Video Reviews A WooCommerce plugin that lets customers attach photos and short videos to their product reviews, shown right in the review list on the product page. WordPress.org: https://wordpress.org/plugins/hdwebmobile-photo-video-reviews/ pending first submission Requires:...

EUVD-2025-209823

The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the wpcbmbestseller shortcode in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-4336

eMagicOne Store Manager para WooCommerce 1: lo: mtu 65536 qdisc noqueue st...

CVE-2024-13513

Oliver POS – A WooCommerce Point of Sale POS = 2.4.2.3 - Sensitive Information Exposure to Privilege Escalation Account TakeOver CVE-2024-13513 The Oliver POS – A WooCommerce Point of Sale POS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includin...

CVE-2025-2266

🚨 CVE-2025-2266 — WordPress Plugin Exploit 🔍 Vulnerability Summary The Checkout Mestres do WP for WooCommerce plugin for WordPress is affected by an unauthenticated arbitrary options update vulnerability in versions 8.6.5 through 8.7.5. The vulnerable function cwmpUpdateOptions lacks proper...

CVE-2026-82215

The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before acting on them, allowing unauthenticated attackers who know the store's merchant identifier to mark arbitrary orders as paid, or to cancel...

CVE-2026-82215 WC PayPay Gateway 0.5 - 0.9.3 - Unauthenticated Payment Bypass via Unverified Webhook

The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before acting on them, allowing unauthenticated attackers who know the store's merchant identifier to mark arbitrary orders as paid, or to cancel...

CVE-2026-82215 WC PayPay Gateway 0.5 - 0.9.3 - Unauthenticated Payment Bypass via Unverified Webhook

The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before acting on them, allowing unauthenticated attackers who know the store's merchant identifier to mark arbitrary orders as paid, or to cancel...

WordPress Payment Gateway PayPay for WooCommerce plugin 0.5-0.9.3 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by Pedro Pinho in WordPress Plugin Payment Gateway PayPay for WooCommerce versions 0.5-0.9.3...