CVE-2024-13638

The CVE-2024-13638 entry concerns the WordPress plugin Order Attachments for WooCommerce. Affected versions are all up to and including 2.5.1, with exploitation via the uploads directory (/wp-content/uploads). The issue enables unauthenticated attackers to access sensitive data stored in attachme...

EUVD-2024-53967

The WooCommerce Ultimate Gift Card plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'mwbwgmpreviewmail' and 'mwbwgmwoocommerceaddcartitemdata' functions in all versions up to, and including, 2.6.0. This makes it possible for...

CVE-2024-8425

The CVE-2024-8425 entry concerns the WordPress WooCommerce Ultimate Gift Card plugin (versions up to 2.6.0). The root cause is insufficient file type validation in mwb_wgm_preview_mail and mwb_wgm_woocommerce_add_cart_item_data, allowing unauthenticated arbitrary file uploads to the server and po...

CVE-2024-8425 WooCommerce Ultimate Gift Card <= 2.9.2 - Unauthenticated Arbitrary File Upload

The WooCommerce Ultimate Gift Card plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'mwbwgmpreviewmail' and 'mwbwgmwoocommerceaddcartitemdata' functions in all versions up to, and including, 2.9.2. This makes it possible for...

CVE-2024-10563

The WooCommerce Cart Count Shortcode WordPress plugin before 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site...

WordPress Order Attachments for WooCommerce plugin <= 2.5.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory vulnerability

Unauthenticated Sensitive Information Exposure Through Unprotected Directory vulnerability discovered by Tim Coen in WordPress Plugin Order Attachments for WooCommerce versions = 2.5.1...

PT-2025-9084 · WordPress · The Nextmove Lite – Thank You Page For Woocommerce

Name of the Vulnerable Software and Affected Versions: NextMove Lite – Thank You Page for WooCommerce plugin for WordPress versions up to, and including, 2.19.0 Description: The issue arises from a missing capability check on the submit uninstall reason action function, allowing authenticated...

PT-2025-9068 · WordPress · Order Attachments For Woocommerce

Name of the Vulnerable Software and Affected Versions: Order Attachments for WooCommerce plugin for WordPress version 2.5.1 and earlier Description: The issue allows unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads directory, which can contain file...

WordPress Tabs for WooCommerce plugin <= 1.0.0 - Authentiated (Shop Manager+) PHP Object Injection in product_has_custom_tabs vulnerability

Authentiated Shop Manager+ PHP Object Injection in producthascustomtabs vulnerability discovered by Francesco Carlucci in WordPress Plugin Tabs for WooCommerce versions = 1.0.0...

CVE-2025-27355

Cross-Site Request Forgery CSRF vulnerability in Nicolas GRILLET Woocommerce – Loi Hamon loi-hamon allows Stored XSS.This issue affects Woocommerce – Loi Hamon: from n/a through = 1.1.0...

CVE-2024-10563 WooCommerce Cart Count Shortcode < 1.1.0 - Contributor+ XSS

The WooCommerce Cart Count Shortcode WordPress plugin before 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site...

CVE-2025-26928 WordPress Order Limit for WooCommerce plugin <= 3.0.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Xfinitysoft Order Limit for WooCommerce wc-order-limit-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Limit for WooCommerce: from n/a through = 3.0.2...

WordPress Direct Checkout Button for WooCommerce plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by theviper17 in WordPress Plugin Direct Checkout Button for WooCommerce versions = 1.0...

WordPress Place Order Without Payment for WooCommerce plugin <= 2.6.7 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Dimas Maulana Patchstack Alliance in WordPress Plugin WC Place Order Without Payment versions = 2.6.7...

CVE-2024-13461 Autoship Cloud for WooCommerce Subscription Products <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Autoship Cloud for WooCommerce Subscription Products plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'autoship-create-scheduled-order-action' shortcode in all versions up to, and including, 2.8.0 due to insufficient input sanitization and output escaping on...

CVE-2024-13461

CVE-2024-13461 affects Autoship Cloud for WooCommerce Subscription Products (WordPress). The vulnerability is a Stored Cross-Site Scripting (XSS) via the autoship-create-scheduled-order-action shortcode, affecting all versions up to 2.8.0, caused by insufficient input sanitization and output esca...

WordPress Better Customer List for WooCommerce Plugin <= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Better Customer List for WooCommerce versions = 1.2.3...

WordPress QR Code for WooCommerce Plugin <= 1.2.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin QR Code for WooCommerce versions = 1.2.0...

CVE-2024-13520

The Gift Cards Gift Vouchers and Packages WooCommerce Supported plugin for WordPress is vulnerable to unauthorized modification of data|loss of data due to a missing capability check on the 'updatevoucherprice', 'updatevoucherdate', 'updatevouchernote' functions in all versions up to, and...

CVE-2025-1064

The Login/Signup Popup Inline Form + Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's xooelaction shortcode in all versions up to, and including, 2.8.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes ...