PT-2025-2165 · WordPress · Ni Sales Commission For Woocommerce

Name of the Vulnerable Software and Affected Versions: Ni Sales Commission For WooCommerce plugin for WordPress versions up to, and including, 1.2.4 Description: The issue is related to unauthorized access due to a missing capability check on the "niwoosc ajax" AJAX endpoint. This allows...

WordPress plugin Barcode Generator for WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress ECPay Ecommerce for WooCommerce plugin <= 1.1.2411060 - Missing Authorization to Authenticated (Subscriber+) Log Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Log Deletion vulnerability discovered by incognito in WordPress Plugin ECPay Ecommerce for WooCommerce versions = 1.1.2411060...

CVE-2024-13652

The ECPay Ecommerce for WooCommerce plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'clearecpaydebuglog' AJAX action in all versions up to, and including, 1.1.2411060. This makes it possible for authenticated attackers, with Subscriber-leve...

CVE-2024-13652 ECPay Ecommerce for WooCommerce <= 1.1.2411060 - Missing Authorization to Authenticated (Subscriber+) Log Deletion

The ECPay Ecommerce for WooCommerce plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'clearecpaydebuglog' AJAX action in all versions up to, and including, 1.1.2411060. This makes it possible for authenticated attackers, with Subscriber-leve...

CVE-2024-13652

Summary: CVE-2024-13652 affects the WordPress plugin ECPay Ecommerce for WooCommerce, version range up to and including 1.1.2411060. The vulnerability arises from a missing capability check on the AJAX action clear_ecpay_debug_log, enabling authenticated users with Subscriber-level access or high...

PT-2025-2236 · WordPress · Ecpay Ecommerce For Woocommerce

Name of the Vulnerable Software and Affected Versions: ECPay Ecommerce for WooCommerce plugin for WordPress versions up to, and including, 1.1.2411060 Description: The issue is related to a missing capability check on the 'clear ecpay debug log' AJAX action. This allows authenticated attackers wi...

WordPress Flexible Wishlist for WooCommerce plugin <= 1.2.25 - Unauthenticated Stored Cross-Site Scripting via wishlist_name Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via wishlistname Parameter vulnerability discovered by Tim Coen in WordPress Plugin Flexible Wishlist for WooCommerce versions = 1.2.25...

CVE-2024-13696 Flexible Wishlist for WooCommerce <= 1.2.25 - Unauthenticated Stored Cross-Site Scripting via wishlist_name Parameter

The Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wishlistname’ parameter in all versions up to, and including, 1.2.25 due to insufficient input sanitization and output escaping. This makes it...

CVE-2025-24603 WordPress Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce plugin <= 3.4.10 - Broken Access Control vulnerability

Missing Authorization vulnerability in Dmitry V. CEO of "UKR Solution" Print Barcode Labels for your WooCommerce products/orders a4-barcode-generator.This issue affects Print Barcode Labels for your WooCommerce products/orders: from n/a through = 3.4.10...

WordPress Custom Product Tabs Lite for WooCommerce plugin <= 1.9.0 - Authenticated (Shop Manager+) PHP Object Injection vulnerability

Authenticated Shop Manager+ PHP Object Injection vulnerability discovered by Francesco Carlucci in WordPress Plugin Custom Product Tabs Lite for WooCommerce versions = 1.9.0...

PT-2025-1821 · Woocommerce · Wc Affiliate

Name of the Vulnerable Software and Affected Versions: WC Affiliate – A Complete WooCommerce Affiliate Plugin versions up to, and including, 2.4 Description: The issue is related to Reflected Cross-Site Scripting, which occurs due to insufficient input sanitization and output escaping. This allow...

CVE-2024-12826

The GoHero Store Customizer for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the woohactionsettingssavefrontend function in all versions up to, and including, 3.5. This makes it possible for unauthenticated attackers to...

CVE-2024-12826 GoHero Store Customizer for WooCommerce <= 3.5 - Missing Authorization to Unuthenticated Settings Update

The GoHero Store Customizer for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the woohactionsettingssavefrontend function in all versions up to, and including, 3.5. This makes it possible for unauthenticated attackers to...

CVE-2024-12600

The Custom Product Tabs Lite for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.0 via deserialization of untrusted input from the 'frswooproducttabs' parameter. This makes it possible for authenticated attackers, with Shop...

CVE-2024-12600

CVE-2024-12600 affects the WordPress plugin Custom Product Tabs Lite for WooCommerce (all versions up to 1.9.0). Root cause: PHP Object Injection via deserialization of untrusted input from the frs_woo_product_tabs parameter. Impact per sources: authenticated attackers with Shop Manager level or ...

CVE-2025-24644

CVE-2025-24644 affects WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels (WebToffee) versions up to 4.7.1. Root cause: improper neutralization of input during web page generation, enabling stored XSS. Public references indicate remediation to version 4.7.2 (update requir...

CVE-2025-24647

CVE-2025-24647 is a CSRF vulnerability in the WordPress plugin WooCommerce Cloak Affiliate Links (versions 1.0.35 and earlier). The issue allows Cross Site Request Forgery. CVSS v3.1 metrics (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) yield a base score of 5.4 (Medium). All connected sources identify t...

CVE-2025-24633

CVE-2025-24633 describes a missing/broken authorization in the WordPress plugin Build Private Store For Woocommerce (versions

CVE-2025-23991

Missing Authorization vulnerability in Dotstore Product Size Charts Plugin for WooCommerce woo-advanced-product-size-chart.This issue affects Product Size Charts Plugin for WooCommerce: from n/a through = 2.4.5...