CVE-2025-22352

1️⃣ Tipo de componente Plugin WordPress 2️⃣ Detalhes do componente Nome do componente ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes Versão vulnerável = 1.4.8 Slug do componente elex-bulk-edit-products-prices-attributes-for-woocommerce-basic Link do componente...

CVE-2025-15260

CVE-2025-15260: Autorizzazione Mancante / Controllo di Accesso Interrotto nel Plugin - MyRewards – Loyalty Points and Rewards for WooCommerce Disclaimer: Questo repository è creato solo per scopi educativi e divulgazione etica. La vulnerabilità è stata segnalata responsabilmente al fornitore e...

CVE-2026-77695

The Return Refund and Exchange For WooCommerce WordPress plugin before 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX actions it exposes to unauthenticated users, allowing them to read private order messages, post messages and attachments in the customer's name,...

EUVD-2026-66283

The Order Tip for WooCommerce WordPress plugin before 1.6.0 does not check the capability of the user requesting a file deletion, nor does it restrict which path may be deleted, allowing users with the Shop Manager role and above to delete arbitrary files on the server, which could lead to the si...

WordPress OrderConvo < 14 - Path Traversal

WooCommerce OrderConvo WordPress plugin \u003C 14 contains a path traversal vulnerability caused by improper validation of file download paths, letting unauthenticated attackers read or download arbitrary files remotely id: CVE-2025-10162 info: name: WordPress OrderConvo 14 - Path Traversal autho...

WCAPF WooCommerce Ajax Product Filter - SQL Injection

WCAPF WooCommerce Ajax Product Filter = 4.2.3 contains a time-based SQL injection caused by insufficient escaping of the 'post-author' parameter, letting unauthenticated attackers extract sensitive database information remotely. id: CVE-2026-3396 info: name: WCAPF WooCommerce Ajax Product Filter ...

Hippoo Mobile App for WooCommerce <= 1.9.4 - Authentication Bypass to Admin Account Takeover

Hippoo Mobile App for WooCommerce WordPress plugin = 1.9.4 contains an authentication bypass caused by logic conflation in user permission checks, letting unauthenticated attackers take over administrator accounts via REST API password reset. id: CVE-2026-10580 info: name: Hippoo Mobile App for...

Custom Product Tabs for WooCommerce < 1.7.8 - Unauthenticated Toggle Content Setting Update

YIKES Inc. Custom Product Tabs for WooCommerce plugin \u003C= 1.7.7 contains a broken access control caused by improper permission checks in &yikes-the-content-toggle option update, letting attackers modify content without authorization. id: CVE-2022-28666 info: name: Custom Product Tabs for...

WooRefer

WooRefer | CVE-2022-4047 - Reso, Rimborso e Scambio per WooCommerce Strumento automatico di massa per verificare e sfruttare la vulnerabilità in CVE-2022-4047 - Reso, Rimborso e Scambio per WooCommerce install.sh sha1sum install.sh | grep 12345678 md5sum install.sh...

CVE-2025-4602

eMagicOne Store Manager per WooCommerce = 1.2.5 - Lettura Arbitraria di File Non Autenticata Il plugin eMagicOne Store Manager per WooCommerce espone un endpoint del protocollo di gestione remota ?connector=bridge che consente operazioni di eliminazione di file sul server. Il meccanismo di...

CVE-2025-4336

eMagicOne Store Manager per WooCommerce 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group...

CVE-2025-2907

CVE-2025-2907 Exploit Details Veröffentlicht : 2025-04-04 Aktualisiert : 2025-03-28 Schweregrad : Kritisch CVSS-Score: 9.8 CWE : CWE-862: CWE-862 Fehlende Autorisierung Betroffene Versionen : Alle Versionen von n/a bis 12.3.1 Forscher :...

CVE-2024-54262

CVE-2024-54262 Import Export For WooCommerce = 1.5 - Upload Arbitrário de Arquivo Autenticado Assinante+ Descrição O plugin Import Export For WooCommerce para WordPress é vulnerável a uploads arbitrários de arquivos devido à falta de validação de tipo de arquivo em todas as versões até, e...

CVE-2025-2266

🚨 CVE-2025-2266 — Exploit del plugin WordPress 🔍 Riepilogo della vulnerabilità Il plugin Checkout Mestres do WP for WooCommerce per WordPress è affetto da una vulnerabilità di aggiornamento arbitrario delle opzioni senza autenticazione nelle versioni 8.6.5 fino a 8.7.5. La funzione vulnerabile...

EUVD-2026-64797

Unauthenticated Arbitrary File Deletion in WooCommerce File Approval = 10.7 versions...

CVE-2025-1661

CVE-2025-1661 – Unauthentifizierte Local File Inclusion LFI in HUSKY – Products Filter Professional für WooCommerce Beschreibung Das HUSKY – Products Filter Professional für WooCommerce -Plugin für WordPress ist in allen Versionen bis einschließlich 1.3.6.5 anfällig für Local File Inclusion LFI...

CVE-2024-13513

Oliver POS – Um WooCommerce Point of Sale POS = 2.4.2.3 - Exposição de Informações Sensíveis para Escalação de Privilégios Tomada de Conta CVE-2024-13513 O plugin Oliver POS – Um WooCommerce Point of Sale POS para WordPress é vulnerável à Exposição de Informações Sensíveis em todas as versões até...

CVE-2026-18027 WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 4.9.8 - Authenticated (Subscriber+) Arbitrary File Read via 'customer_note' Parameter

The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.9.8 via the getimagesrcinbase64 function. This makes it possible for authenticated attackers, with...

CVE-2026-18027

The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 4.9.8 . The flaw resides in the get_image_src_in_base64 function, which processes the customer_note parameter witho...

CVE-2026-77264 Automation Web Platform <= 4.8.6 - Unauthenticated Authentication Bypass via 'otp_transient' Token Disclosure

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 4.8.6. This is due to the handleemailotpreturn function returning the secret magic login token in the response t...