CVE-2025-47504

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPFactory Custom Checkout Fields for WooCommerce custom-checkout-fields-for-woocommerce allows Stored XSS.This issue affects Custom Checkout Fields for WooCommerce: from n/a through = 1.8.3...

CVE-2025-47472

Missing Authorization vulnerability in codepeople Music Player for WooCommerce music-player-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Music Player for WooCommerce: from n/a through = 1.5.1...

CVE-2025-47473

Cross-Site Request Forgery CSRF vulnerability in pimwick PW WooCommerce Bulk Edit pw-bulk-edit allows Cross Site Request Forgery.This issue affects PW WooCommerce Bulk Edit: from n/a through = 2.134...

CVE-2025-47460

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in TrackShip TrackShip for WooCommerce trackship-for-woocommerce allows SQL Injection.This issue affects TrackShip for WooCommerce: from n/a through = 1.9.1...

CVE-2025-47451

Cross-Site Request Forgery CSRF vulnerability in silverplugins217 Product Quantity Dropdown For Woocommerce product-quantity-dropdown-for-woocommerce allows Cross Site Request Forgery.This issue affects Product Quantity Dropdown For Woocommerce: from n/a through = 1.2...

CVE-2025-47455

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in CRM Perks Integration for WooCommerce and Salesforce woo-salesforce-plugin-crm-perks allows Phishing.This issue affects Integration for WooCommerce and Salesforce: from n/a through = 1.7.5...

WordPress Open Close WooCommerce Store plugin <= 4.9.9 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Open Close WooCommerce Store versions = 4.9.9...

WordPress Pays – WooCommerce Payment Gateway plugin <= 2.6 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Pays – WooCommerce Payment Gateway versions = 2.6...

WordPress Calculate Prices based on Distance For WooCommerce plugin <= 1.3.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by ch4r0n in WordPress Plugin Calculate Prices based on Distance For WooCommerce versions = 1.3.5...

CVE-2025-47649 WordPress Open Close WooCommerce Store <= 4.9.5 - Local File Inclusion Vulnerability

Path Traversal vulnerability in ilmosys Open Close WooCommerce Store allows PHP Local File Inclusion. This issue affects Open Close WooCommerce Store: from n/a through 4.9.5...

CVE-2025-47649 WordPress Open Close WooCommerce Store plugin <= 4.9.9 - Local File Inclusion vulnerability

Path Traversal: '.../...//' vulnerability in StackWC Open Close WooCommerce Store woc-open-close allows PHP Local File Inclusion.This issue affects Open Close WooCommerce Store: from n/a through = 4.9.9...

CVE-2025-47649

CVE-2025-47649 : Path traversal leading to PHP Local File Inclusion in the WordPress plugin “Open Close WooCommerce Store” (ilmosys). Affected: Open Close WooCommerce Store

CVE-2025-47648 WordPress Pays – WooCommerce Payment Gateway plugin <= 2.6 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in axima Pays – WooCommerce Payment Gateway axima-payment-gateway allows Stored XSS.This issue affects Pays – WooCommerce Payment Gateway: from n/a through = 2.6...

CVE-2025-47648 WordPress Pays – WooCommerce Payment Gateway plugin <= 2.6 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in axima Pays – WooCommerce Payment Gateway axima-payment-gateway allows Stored XSS.This issue affects Pays – WooCommerce Payment Gateway: from n/a through = 2.6...

CVE-2025-47648

CVE-2025-47648 describes a Cross-Site Request Forgery (CSRF) vulnerability in the Pays – WooCommerce Payment Gateway plugin for WordPress, affecting versions n/a through 2.6. The issue enables a Stored XSS scenario as noted in multiple sources. Public technical details in connected documents conf...

CVE-2025-47643

CVE-2025-47643 concerns ELEX Product Feed for WooCommerce (WordPress plugin). Affected versions are 3.1.2 and earlier, with the root cause described as improper neutralization of special elements in SQL commands, i.e., SQL Injection. The CVE is associated with multiple sources (NVD/Red Hat/CVE li...

CVE-2025-47643 WordPress ELEX Product Feed for WooCommerce <= 3.1.2 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in ELEXtensions ELEX Product Feed for WooCommerce allows SQL Injection. This issue affects ELEX Product Feed for WooCommerce: from n/a through 3.1.2...

CVE-2025-47633 WordPress Awin – Advertiser Tracking for WooCommerce plugin <= 2.0.0 - CSRF to Product Feed Regeneration vulnerability

Cross-Site Request Forgery CSRF vulnerability in Awin Awin – Advertiser Tracking for WooCommerce awin-advertiser-tracking allows Cross Site Request Forgery.This issue affects Awin – Advertiser Tracking for WooCommerce: from n/a through = 2.0.0...

CVE-2025-47633 WordPress Awin – Advertiser Tracking for WooCommerce plugin <= 2.0.0 - CSRF to Product Feed Regeneration vulnerability

Cross-Site Request Forgery CSRF vulnerability in Awin Awin – Advertiser Tracking for WooCommerce awin-advertiser-tracking allows Cross Site Request Forgery.This issue affects Awin – Advertiser Tracking for WooCommerce: from n/a through = 2.0.0...

CVE-2025-47633

CVE-2025-47633 is a CSRF vulnerability in the WordPress plugin Awin – Advertiser Tracking for WooCommerce, affecting versions n/a through 2.0.0. The issue arises from insufficient verification of requests, enabling Cross-Site Request Forgery to trigger product-feed regeneration. Public sources (P...