PT-2025-25684 · WordPress · Wpexperts Hub Woocommerce Partial Shipment

Name of the Vulnerable Software and Affected Versions: WpExperts Hub Woocommerce Partial Shipment versions n/a through 3.2 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection...

WordPress WooCommerce Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in WordPress WooCommerce that stems from insufficient PostMessage data input cleanup and output escaping, which can be exploited by a...

PT-2025-25671 · Rapyd · Rapyd Payment Extension For Woocommerce

Name of the Vulnerable Software and Affected Versions: Rapyd Payment Extension for WooCommerce versions 1.2.0 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. This can potentially be exploited, although specific details about the...

CVE-2025-5238

The YITH WooCommerce Wishlist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2025-5238

The YITH WooCommerce Wishlist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2025-5238 YITH WooCommerce Wishlist <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter

The YITH WooCommerce Wishlist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2025-5238

CVE-2025-5238 affects the YITH WooCommerce Wishlist plugin for WordPress. The issue is a stored cross-site scripting (XSS) vulnerability in the id parameter present in versions up to and including 4.5.0, caused by insufficient input sanitization and output escaping. Exploitation requires authenti...

WordPress plugin YITH WooCommerce Wishlist 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2025-25485 · WordPress · Yith Woocommerce Wishlist

Name of the Vulnerable Software and Affected Versions: YITH WooCommerce Wishlist plugin for WordPress versions up to, and including, 4.5.0 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticated attacke...

WordPress plugin Zagg - Electronics & Accessories WooCommerce WordPress Theme Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Automattic: Woocommerce SQL Injection in WC_Report_Coupon_Usage

A SQL injection vulnerability was found in the WooCommerce plugin version 9.9.3. The vulnerable parameter was 'couponcodes' in the '/wp-admin/admin.php?page=wc-reports&tab=orders&report=couponusage' endpoint. The vulnerability required the privilege to view reports...

The vulnerability of the TI WooCommerce Wishlist plugin for WordPress content management system allows a hacker to write arbitrary files.

The vulnerability of the TI WooCommerce Wishlist plugin for WordPress content management system is related to the ability to download files of a dangerous type without limitation. Exploiting this vulnerability could allow an attacker to write arbitrary files...

WordPress Recover Abandoned Cart for WooCommerce SQL Injection Vulnerability

WordPress Recover Abandoned Cart for WooCommerce is a plugin designed to recover unfinished orders in WooCommerce. A SQL injection vulnerability exists in WordPress Recover Abandoned Cart for WooCommerce. The vulnerability stems from improper neutralization of special elements. An attacker can...

CVE-2025-49510

Cross-Site Request Forgery CSRF vulnerability in WPFactory Min Max Step Quantity Limits Manager for WooCommerce product-quantity-for-woocommerce allows Cross Site Request Forgery.This issue affects Min Max Step Quantity Limits Manager for WooCommerce: from n/a through = 5.1.0...

CVE-2025-47463

Missing Authorization vulnerability in Fahad Mahmood Stock Locations for WooCommerce stock-locations-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stock Locations for WooCommerce: from n/a through = 2.8.6...

CVE-2025-47608

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in sonalsinha21 Recover abandoned cart for WooCommerce recover-wc-abandoned-cart allows SQL Injection.This issue affects Recover abandoned cart for WooCommerce: from n/a through = 2.5...

CVE-2025-47487

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Moreconvert Team MC Woocommerce Wishlist smart-wishlist-for-more-convert allows Reflected XSS.This issue affects MC Woocommerce Wishlist: from n/a through = 1.9.1...

CVE-2025-49265

Missing Authorization vulnerability in WP Swings Membership For WooCommerce membership-for-woocommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Membership For WooCommerce: from n/a through = 2.8.1...

CVE-2025-24767

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in facturaone TicketBAI Facturas para WooCommerce wp-ticketbai allows Blind SQL Injection.This issue affects TicketBAI Facturas para WooCommerce: from n/a through = 3.19...

CVE-2025-28945

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in snstheme Valen - Sport, Fashion WooCommerce WordPress Theme valen allows PHP Local File Inclusion.This issue affects Valen - Sport, Fashion WooCommerce WordPress Theme: from n/a...