CVE-2024-12600 Custom Product Tabs Lite for WooCommerce <= 1.9.0 - Authenticated (Shop Manager+) PHP Object Injection

The Custom Product Tabs Lite for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.0 via deserialization of untrusted input from the 'frswooproducttabs' parameter. This makes it possible for authenticated attackers, with Shop...

CVE-2025-24681

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpWax Product Carousel Slider & Grid Ultimate for WooCommerce woo-product-carousel-slider-and-grid-ultimate allows Stored XSS.This issue affects Product Carousel Slider & Grid Ultimate for...

CVE-2025-24668

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Themeisle PPOM for WooCommerce woocommerce-product-addon allows Stored XSS.This issue affects PPOM for WooCommerce: from n/a through = 33.0.8...

CVE-2025-24625

Missing Authorization vulnerability in Marco Almeida | Webdados Taxonomy/Term and Role based Discounts for WooCommerce taxonomy-discounts-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Taxonomy/Term and Role based Discounts for WooCommerce:...

CVE-2025-24647 WordPress WooCommerce Cloak Affiliate Links plugin <= 1.0.35 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in datafeedr.com WooCommerce Cloak Affiliate Links allows Cross Site Request Forgery. This issue affects WooCommerce Cloak Affiliate Links: from n/a through 1.0.35...

CVE-2025-22318 WordPress Standard Box Sizes plugin <= 1.6.13 - Broken Access Control vulnerability

Missing Authorization vulnerability in enituretechnology Standard Box Sizes – for WooCommerce standard-box-sizes.This issue affects Standard Box Sizes – for WooCommerce: from n/a through = 1.6.13...

CVE-2024-13317

CVE-2024-13317 affects the ShipWorks Connector for Woocommerce (WordPress) up to version 5.2.5. Root cause: missing/incorrect nonce validation on the shipworks-wordpress page enabling CSRF. Impact: unauthenticated attackers could update the service credentials (username/password) by forging reque...

CVE-2025-22724

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in MojofyWP Product Carousel For WooCommerce – WoorouSell allows Stored XSS.This issue affects Product Carousel For WooCommerce – WoorouSell: from n/a through 1.1.0...

CVE-2025-22337

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in infosoftplugin Order Audit Log for WooCommerce order-audit-log-for-woocommerce allows Reflected XSS.This issue affects Order Audit Log for WooCommerce: from n/a through = 2.0...

CVE-2025-22337

CVE-2025-22337 is a Reflected XSS vulnerability in the WordPress plugin Order Audit Log for WooCommerce (Infosoft) affecting versions up to 2.0. The flaw stems from improper input neutralization during web page generation, enabling reflected cross-site scripting. The Red Hat advisory (RH:CVE-2025...

CVE-2024-11815 Pósturinn\'s Shipping with WooCommerce <= 1.3.1 - Reflected Cross-Site Scripting

The Pósturinn\s Shipping with WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the printedmarked and nonprintedmarked parameters in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-12222 Deliver via Shipos for WooCommerce <= 2.1.7 - Reflected Cross-Site Scripting via dvsfw_bulk_label_url Parameter

The Deliver via Shipos for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘dvsfwbulklabelurl’ parameter in all versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2024-11423 Ultimate Gift Cards for WooCommerce <= 3.0.6 - Missing Authorization to Infinite Money Glitch

The Ultimate Gift Cards for WooCommerce – Create WooCommerce Gift Cards, Gift Vouchers, Redeem & Manage Digital Gift Coupons. Offer Gift Certificates, Schedule Gift Cards, and Use Advance Coupons With Personalized Templates plugin for WordPress is vulnerable to unauthorized modification of data d...

CVE-2025-22363

Missing Authorization vulnerability in Hermann LAHAMI Allada T-shirt Designer for Woocommerce allada-tshirt-designer-for-woocommerce.This issue affects Allada T-shirt Designer for Woocommerce: from n/a through = 1.1...

CVE-2024-11725 SMS Alert Order Notifications – WooCommerce <= 3.7.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update

The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the updateWcWarrantySettings function in all versions up to, and including, 3.7.6. This makes it...

CVE-2024-11369

CVE-2024-11369 affects the WordPress plugin Store credit / Gift cards for WooCommerce (Store credit for WooCommerce). It is a Reflected Cross-Site Scripting vulnerability exploitable via the coupon, start_date, and end_date parameters in all versions up to 1.0.49.46, caused by insufficient input ...

CVE-2024-11378 Bizapp for WooCommerce <= 2.0.8 - Reflected Cross-Site Scripting

The Bizapp for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'error' parameter in all versions up to, and including, 2.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...

CVE-2024-11465 Custom Product Tabs for WooCommerce <= 1.8.5 - Authenticated (Shop Manager+) PHP Object Injection

The Custom Product Tabs for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input in the 'yikeswooproductstabs' post meta parameter. This makes it possible for authenticated attackers, with Shop...

CVE-2024-56207

CVE-2024-56207 involves a CSRF vulnerability in EditionGuard for WooCommerce – eBook Sales with DRM, enabling Privilege Escalation. Affected product: EditionGuard for WooCommerce – eBook Sales with DRM; affected versions: n/a through 3.4.2. The initial and connected documents note a high severity...

CVE-2024-56228

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPFactory Wishlist for WooCommerce wish-list-for-woocommerce.This issue affects Wishlist for WooCommerce: from n/a through = 3.1.2...