CVE-2026-32410: Missing Authorization

Missing Authorization vulnerability in WBW Plugins WBW Currency Switcher for WooCommerce woo-currency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WBW Currency Switcher for WooCommerce: from n/a through = 2.2.5...

CVE-2025-30857 WordPress Currency Switcher for WooCommerce plugin <= 0.0.7 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in PressMaximum Currency Switcher for WooCommerce currency-switcher-for-woocommerce allows Stored XSS.This issue affects Currency Switcher for WooCommerce: from n/a through = 0.0.7...

CVE-2025-30857: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in PressMaximum Currency Switcher for WooCommerce currency-switcher-for-woocommerce allows Stored XSS.This issue affects Currency Switcher for WooCommerce: from n/a through = 0.0.7...

PT-2025-13119

Name of the Vulnerable Software and Affected Versions Currency Switcher for WooCommerce versions 0.0.0 through 0.0.7 Description The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

CVE-2024-9217: Improper Neutralization of Input During Web Page Generation

The Currency Switcher for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 2.16.2. This makes it possible for unauthenticated attackers to inject arbitrary w...

PT-2025-9151

Name of the Vulnerable Software and Affected Versions Currency Switcher for WooCommerce plugin for WordPress versions up to, and including, 2.16.2 Description The issue is related to Reflected Cross-Site Scripting, which occurs due to the use of add query arg without proper escaping on the URL...

CVE-2022-2575: Improper Neutralization of Input During Web Page Generation

The WBW Currency Switcher for WooCommerce WordPress plugin before 1.6.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...