CVE-2024-11465

The Custom Product Tabs for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input in the 'yikeswooproductstabs' post meta parameter. This makes it possible for authenticated attackers, with Shop...

CVE-2024-11378

The Bizapp for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'error' parameter in all versions up to, and including, 2.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...

CVE-2024-12435

CVE-2024-12435 affects the WordPress plugin Compare Products for WooCommerce and is a reflected cross-site scripting (XSS) vulnerability via the s_feature parameter in all versions up to and including 3.2.1. Root cause: insufficient input sanitization and lack of proper output escaping. Impact: u...

CVE-2024-12313 Compare Products for WooCommerce <= 3.2.1 - Unauthenticated PHP Object Injection

The Compare Products for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.1 via deserialization of untrusted input from the 'woocomparelist' cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No know...

CVE-2024-12313 Compare Products for WooCommerce <= 3.2.1 - Unauthenticated PHP Object Injection

The Compare Products for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.1 via deserialization of untrusted input from the 'woocomparelist' cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No know...

CVE-2024-11465

CVE-2024-11465 affects the Custom Product Tabs for WooCommerce plugin for WordPress (

CVE-2024-11465 Custom Product Tabs for WooCommerce <= 1.8.5 - Authenticated (Shop Manager+) PHP Object Injection

The Custom Product Tabs for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input in the 'yikeswooproductstabs' post meta parameter. This makes it possible for authenticated attackers, with Shop...

CVE-2024-12049 Woo Ukrposhta <= 1.17.11 - Reflected Cross-Site Scripting via order, post, and idd Parameters

The Woo Ukrposhta plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'order', 'post', and 'idd' parameters in all versions up to, and including, 1.17.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

PT-2025-1838 · Woomotiv · Live Sales Notification For Woocommerce – Woomotiv

Name of the Vulnerable Software and Affected Versions: Live Sales Notification for Woocommerce – Woomotiv plugin for WordPress versions up to, and including, 3.6.1 Description: The issue is related to SQL Injection via the woomotiv seen products . cookie due to insufficient escaping on the...

WordPress plugin ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress plugin ELEX WooCommerce Advanced Bul...

PT-2025-1646 · WordPress · Store Credit / Gift Cards For Woocommerce

Name of the Vulnerable Software and Affected Versions: Store credit / Gift cards for woocommerce plugin for WordPress versions up to, and including, 1.0.49.46 Description: The issue is related to Reflected Cross-Site Scripting via the coupon, start date, and end date parameters due to insufficien...

PT-2025-1681 · Unknown +1 · Woocommerce-Warranty +1

Name of the Vulnerable Software and Affected Versions: SMS Alert Order Notifications – WooCommerce plugin for WordPress versions up to, and including, 3.7.6 Description: The issue concerns unauthorized modification of data that can lead to privilege escalation due to a missing capability check on...

PT-2025-3235 · Woocommerce · Hide Category By User Role For Woocommerce

Name of the Vulnerable Software and Affected Versions: Hide Category by User Role for WooCommerce versions n/a through 2.1.1 Description: The issue is related to a Missing Authorization vulnerability in the ThemeSupport Hide Category by User Role for WooCommerce plugin. This vulnerability affects...

WordPress plugin Custom Product Tabs for WooCommerce 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in...

WordPress plugin Bizapp for WooCommerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site...

WordPress plugin Allada T-shirt Designer for Woocommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress plugin Binary MLM Woocommerce 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

WordPress Korea for WooCommerce plugin <= 1.1.11 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Mika in WordPress Plugin Korea for WooCommerce versions = 1.1.11...

Exploit for CVE-2025-22352

1️⃣ Component type WordPress plugin 2️⃣ Component details...

WordPress Advanced Dynamic Pricing for WooCommerce Plugin <= 4.9.0 -Reflected Cross Site Scripting (XSS) vulnerability

WordPress Advanced Dynamic Pricing for WooCommerce Plugin = 4.9.0 -Reflected Cross Site Scripting XSS vulnerability discovered by b4orvn in WordPress Plugin Advanced Dynamic Pricing for WooCommerce versions = 4.9.0...