CVE-2025-47643

CVE-2025-47643 concerns ELEX Product Feed for WooCommerce (WordPress plugin). Affected versions are 3.1.2 and earlier, with the root cause described as improper neutralization of special elements in SQL commands, i.e., SQL Injection. The CVE is associated with multiple sources (NVD/Red Hat/CVE li...

PT-2025-20157 · Woocommerce · Acowebs Dynamic Pricing With Discount Rules For Woocommerce

Name of the Vulnerable Software and Affected Versions: acowebs Dynamic Pricing With Discount Rules for WooCommerce versions prior to 4.5.9 Description: The issue is related to an SQL Injection vulnerability, specifically an Improper Neutralization of Special Elements used in an SQL Command. This...

CVE-2025-39391 WordPress Checkout Field Visibility for WooCommerce plugin <= 1.3.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in zamartz Checkout Field Visibility for WooCommerce checkout-field-visibility-for-woocommerce allows PHP Local File Inclusion.This issue affects Checkout Field Visibility for...

CVE-2025-3280

The ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin for WordPress is vulnerable to SQL Injection via the 'attributevaluefilter' parameter in all versions up to, and including, 1.4.9 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2025-32533

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Matat Technologies Deliver via Shipos for WooCommerce wc-shipos-delivery allows Reflected XSS.This issue affects Deliver via Shipos for WooCommerce: from n/a through = 2.1.7...

CVE-2025-32535 WordPress DN Shipping by Weight for WooCommerce Plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in digireturn DN Shipping by Weight for WooCommerce dn-shipping-by-weight allows Reflected XSS.This issue affects DN Shipping by Weight for WooCommerce: from n/a through = 1.2...

CVE-2025-39520 WordPress Checkout Files Upload for WooCommerce plugin <= 2.2.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Wham Checkout Files Upload for WooCommerce checkout-files-upload-woocommerce allows Stored XSS.This issue affects Checkout Files Upload for WooCommerce: from n/a through = 2.2.0...

WordPress Additional Custom Product Tabs for WooCommerce plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by muhammad yudha Patchstack Alliance in WordPress Plugin Additional Custom Product Tabs for WooCommerce versions = 1.7.0...

CVE-2025-32586

CVE-2025-32586: ABA PayWay Payment Gateway for WooCommerce has a Reflected Cross-Site Scripting (XSS) flaw in input processing during web page generation, affecting versions up to 2.1.3. The Wordfence entry lists the vulnerability as Unpatched, with a CVSS v3.1 base score of 7.1 (HIGH) and an att...

WordPress MSRP (RRP) Pricing for WooCommerce Plugin <= 1.8.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by 0xd4rk5id3 in WordPress Plugin MSRP RRP Pricing for WooCommerce versions = 1.8.1...

CVE-2025-32209

CVE-2025-32209: Authenticated arbitrary file download in Total processing card payments for WooCommerce (Totalprocessing). The Wordfence vulnerability detail confirms impact and that a patch is available; upgrade to the patched release to mitigate.

CVE-2025-32181

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Fast Simon Search, Filters & Merchandising for WooCommerce instantsearch-for-woocommerce allows Stored XSS.This issue affects Search, Filters & Merchandising for WooCommerce: from n/a through =...

CVE-2025-26541

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CodeSolz Bitcoin / AltCoin Payment Gateway for WooCommerce woo-altcoin-payment-gateway allows Reflected XSS.This issue affects Bitcoin / AltCoin Payment Gateway for WooCommerce: from n/a through =...

CVE-2025-22639 WordPress Distance Rate Shipping for WooCommerce plugin <= 1.3.4 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in NotFound Distance Rate Shipping for WooCommerce allows Blind SQL Injection. This issue affects Distance Rate Shipping for WooCommerce: from n/a through 1.3.4...

CVE-2024-13528

CVE-2024-13528 : The Customer Email Verification for WooCommerce plugin (WordPress) is vulnerable to an authentication bypass. An attacker with Contributor+ privileges can generate a verification link for any unverified user via a shortcode that creates a confirmation link with a placeholder emai...

CVE-2024-5871

The WooCommerce - Social Login plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.2 via deserialization of untrusted input from the 'wooslgverify' vulnerable parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. N...

CVE-2024-10899

The The WooCommerce Product Table Lite plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.8.6. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it...

WordPress plugin Ultimate Gift Cards for WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-11842 DN Shipping by Weight for WooCommerce < 1.2 - Settings Update via CSRF

The DN Shipping by Weight for WooCommerce WordPress plugin before 1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-54342 WordPress Staggs plugin <= 2.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in STAGGS Staggs Product Configurator for WooCommerce allows Reflected XSS.This issue affects Staggs Product Configurator for WooCommerce: from n/a through 2.0.0...