CVE-2025-24553 WordPress Shipping with Venipak for WooCommerce plugin <= 1.22.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Akadrama Shipping with Venipak for WooCommerce wc-venipak-shipping allows Reflected XSS.This issue affects Shipping with Venipak for WooCommerce: from n/a through = 1.22.3...

CVE-2025-32512 WordPress Revamp CRM for WooCommerce plugin <= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in revampcrm Revamp CRM for WooCommerce revampcrm-woocommerce allows Reflected XSS.This issue affects Revamp CRM for WooCommerce: from n/a through = 1.1.2...

CVE-2025-32593

CVE-2025-32593 is a Missing Authorization vulnerability in the WordPress plugin Add Product Frontend for WooCommerce (affected: all versions up to 1.0.6) that allows unauthenticated arbitrary content deletion due to improperly configured access control. This CVE entry appears in multiple sources ...

CVE-2024-13925 Klarna Checkout for WooCommerce < 2.13.5 - DoS via Excessive Logging

The Klarna Checkout for WooCommerce WordPress plugin before 2.13.5 exposes an unauthenticated WooCommerce Ajax endpoint that allows an attacker to flood the log files with data at the maximum size allowed for a POST parameter per request. This can result in rapid consumption of disk space,...

PT-2025-17129 · Woocommerce · Add Product Frontend For Woocommerce

Name of the Vulnerable Software and Affected Versions: Add Product Frontend for WooCommerce versions 1.0.0 through 1.0.6 Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For...

PT-2025-17112 · Woocommerce · Msrp (Rrp) Pricing For Woocommerce

Name of the Vulnerable Software and Affected Versions: MSRP RRP Pricing for WooCommerce versions 1.8.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an...

CVE-2025-39520

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Wham Checkout Files Upload for WooCommerce checkout-files-upload-woocommerce allows Stored XSS.This issue affects Checkout Files Upload for WooCommerce: from n/a through = 2.2.0...

CVE-2025-39602

CVE-2025-39602 is a Missing Authorization vulnerability in the WordPress plugin WooCommerce Product Table Lite (versions up to and including 3.9.5). Multiple sources (NVD, patch provider) confirm the issue, with a CVSS v3.1 base score of 4.3 (Medium) and an impact profile of no confidentiality/av...

CVE-2025-26749

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPFactory Additional Custom Product Tabs for WooCommerce product-tabs-for-woocommerce allows Stored XSS.This issue affects Additional Custom Product Tabs for WooCommerce: from n/a through = 1.7.0...

CVE-2025-32929

CVE-2025-32929 affects the WordPress plugin Barcode Generator for WooCommerce up to version 2.0.4. A missing/weak authorization vulnerability in the plugin’s access control allows an attacker to perform arbitrary content deletion (impact: high availability disruption). CVSS 3.1 base score 7.5 (Ne...

CVE-2025-2719

The Swatchly – WooCommerce Variation Swatches for Products product attributes: Image swatch, Color swatches, Label swatches plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxdismiss function in versions 1.2.8 to 1.4.0. This makes ...

PT-2025-16056 · Woocommerce · Woocommerce – Payphone Gateway

Name of the Vulnerable Software and Affected Versions: WooCommerce – Payphone Gateway versions prior to 3.2.0 Description: The issue is related to improper neutralization of input during web page generation, which allows for Cross-site Scripting XSS. Specifically, it enables Reflected XSS...

CVE-2025-32119 WordPress CardGate Payments for WooCommerce plugin <= 3.2.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in CardGate CardGate Payments for WooCommerce cardgate allows Blind SQL Injection.This issue affects CardGate Payments for WooCommerce: from n/a through = 3.2.1...

CVE-2025-32570 WordPress ChillPay WooCommerce Plugin <= 2.5.3 - CSRF to Stored XSS vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ChillPay ChillPay WooCommerce chillpay-payment-gateway allows Stored XSS.This issue affects ChillPay WooCommerce: from n/a through = 2.5.3...

PT-2025-15792 · Woocommerce · Chillpay Woocommerce

Name of the Vulnerable Software and Affected Versions: ChillPay WooCommerce versions through 2.5.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This enables potential attackers to inject...

CVE-2025-2789

CVE-2025-2789 affects MultiVendorX – WooCommerce Multivendor Marketplace Solutions,

CVE-2025-2789 MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.19 - Missing Authorization to Unauthenticated Table Rates Deletion

The MultiVendorX – Empower Your WooCommerce Store with a Dynamic Multivendor Marketplace – Build the Next Amazon, eBay, Etsy plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the deletetablerateshippingrow function in all versions up to, and...

CVE-2025-32263

Cross-Site Request Forgery CSRF vulnerability in BeRocket Sequential Order Numbers for WooCommerce sequential-order-numbers-for-woocommerce allows Cross Site Request Forgery.This issue affects Sequential Order Numbers for WooCommerce: from n/a through = 3.6.2...

CVE-2025-22285

Missing Authorization vulnerability in enituretechnology Pallet Packaging for WooCommerce pallet-packaging-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pallet Packaging for WooCommerce: from n/a through = 1.1.15...

CVE-2024-13744

The Booster for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the validateproductinputfieldsonaddtocart function in versions 4.0.1 to 7.2.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the...