CVE-2025-22352

1️⃣ 组件类型 WordPress 插件 2️⃣ 组件详细信息 组件名称 ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes 受影响版本 producttitletext、range 也会被直接传递到查询中，但由...

CVE-2025-2907

CVE-2025-2907 漏洞利用 详细信息 发布日期 : 2025-04-04 更新日期 : 2025-03-28 严重性 : 严重 CVSS 评分: 9.8 CWE : CWE-862: CWE-862 授权缺失 受影响版本 : 从 n/a 到 12.3.1 的所有版本 研究人员 : https://www.wordfence.com/threat-intel/vulnerabilities/researchers/mike-gozdiskowski CVSS 向量 CVSS 版本 : 9.8 向量字符串 :...

CVE-2025-4336

eMagicOne Store Manager for WooCommerce 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo validlft forever preferredlft forever inet6 ::1/128 scope host validlft forever preferredlft forever 2:...

CVE-2024-13513

Oliver POS – WooCommerce 销售点 POS 插件 = 2.4.2.3 - 敏感信息泄露导致权限提升（账户接管） CVE-2024-13513 WordPress 的 Oliver POS – WooCommerce 销售点 POS 插件在包括 2.4.2.3 在内的所有版本中，通过日志功能存在敏感信息泄露漏洞。这使得未经身份验证的攻击者能够提取敏感数据，包括插件的 clientToken，进而可用于更改用户账户信息（如电子邮件和账户类型）。攻击者随后可以更改账户密码，导致完全接管网站。2.4.2.3 版本禁用了日志记录，但已存在日志文件的网站仍存在漏洞。 如需更多...

CVE-2025-4602

eMagicOne Store Manager for WooCommerce = 1.2.5 - 未经认证的任意文件读取 eMagicOne Store Manager for WooCommerce 插件暴露了一个远程管理协议端点（?connector=bridge），允许在服务器上执行文件删除操作。其认证机制依赖于一组默认凭据（login=1，password=1）和会话密钥系统。如果默认凭据未被更改，攻击者可以轻易地进行认证，获取会话密钥，并从 WordPress 根目录或任何可访问的目录读取任意文件。 复现 提供了一个 POC CVE-2025-4602.py 来演示从服务器读...

Hippoo Mobile App for WooCommerce <= 1.9.4 - Authentication Bypass to Admin Account Takeover

Hippoo Mobile App for WooCommerce WordPress plugin = 1.9.4 contains an authentication bypass caused by logic conflation in user permission checks, letting unauthenticated attackers take over administrator accounts via REST API password reset. id: CVE-2026-10580 info: name: Hippoo Mobile App for...

WordPress OrderConvo < 14 - Path Traversal

WooCommerce OrderConvo WordPress plugin \u003C 14 contains a path traversal vulnerability caused by improper validation of file download paths, letting unauthenticated attackers read or download arbitrary files remotely id: CVE-2025-10162 info: name: WordPress OrderConvo 14 - Path Traversal autho...

WCAPF WooCommerce Ajax Product Filter - SQL Injection

WCAPF WooCommerce Ajax Product Filter = 4.2.3 contains a time-based SQL injection caused by insufficient escaping of the 'post-author' parameter, letting unauthenticated attackers extract sensitive database information remotely. id: CVE-2026-3396 info: name: WCAPF WooCommerce Ajax Product Filter ...

Custom Product Tabs for WooCommerce < 1.7.8 - Unauthenticated Toggle Content Setting Update

YIKES Inc. Custom Product Tabs for WooCommerce plugin \u003C= 1.7.7 contains a broken access control caused by improper permission checks in &yikes-the-content-toggle option update, letting attackers modify content without authorization. id: CVE-2022-28666 info: name: Custom Product Tabs for...

WooRefer

WooRefer | CVE-2022-4047 - Return Refund and Exchange For WooCommerce 用于检测和利用 CVE-2022-4047 漏洞的自动化批量工具 - Return Refund and Exchange For WooCommerce install.sh sha1sum install.sh | grep 12345678 md5sum install.sh sha512sum install.sh bash install.sh 使用方法 请确保你已经安装了 Parallel！ 然后执行： git clone...

CVE-2025-1661

CVE-2025-1661 - Unauthenticated Local File Inclusion LFI in HUSKY – Products Filter Professional for WooCommerce Description The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion LFI in all versions up to and including 1.3.6.5 via the...

CVE-2025-2266

🚨 CVE-2025-2266 — WordPress 插件漏洞利用 🔍 漏洞概述 Checkout Mestres do WP for WooCommerce WordPress 插件在 8.6.5 至 8.7.5 版本中存在 未经身份验证的任意选项更新漏洞 。 有漏洞的函数 cwmpUpdateOptions 缺少适当的能力检查，允许 未经验证的攻击者 更新任意 WordPress 选项。 ⚠️ 风险与利用 攻击者可： 启用用户注册 将默认角色设置为 administrator 注册一个新账户，该账户将自动获得 管理员权限 🧨 漏洞详情 CVE ID : CVE-2025-2266...

CVE-2024-54262

CVE-2024-54262 WooCommerce 导入导出插件 = 1.5 - 认证用户（订阅者及以上）任意文件上传 描述 WordPress 的 WooCommerce 导入导出插件在所有版本（包括 1.5）中存在任意文件上传漏洞，原因是缺少文件类型验证。这使得经过身份验证的攻击者（拥有订阅者及以上级别访问权限）能够在受影响站点的服务器上上传任意文件，从而可能导致远程代码执行。 详情 类型 : plugin 标识 : import-export-for-woocommerce 受影响版本 : 1.5 CVSS 分数 : 9.9 CVSS 评级 : Critical CVSS 向量 ...

CVE-2026-82215

The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before acting on them, allowing unauthenticated attackers who know the store's merchant identifier to mark arbitrary orders as paid, or to cancel...

CVE-2026-82215 WC PayPay Gateway 0.5 - 0.9.3 - Unauthenticated Payment Bypass via Unverified Webhook

The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before acting on them, allowing unauthenticated attackers who know the store's merchant identifier to mark arbitrary orders as paid, or to cancel...

CVE-2026-8778

The MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields. plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the miplwcuploadfile function in all versions up to, and including, 1.2.1. This makes it possible for...

CVE-2026-18562

HUSKY – Products Filter Professional for WooCommerce (WordPress plugin) versions up to and including 1.4.3 are affected by a Reflected Cross-Site Scripting vulnerability. The root cause is insufficient output escaping in the wp_load_js() function of the url_request extension: filter values read f...

EUVD-2026-75928

The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authentication Bypass via OTP Brute Force in all versions up to, and including, 2.7.2. The vulnerability exists because the OTP rate-limit attempt counter in processotpform is keyed exclusively on the attacker-controlled...

CVE-2025-15260

CVE-2025-15260：插件 MyRewards – WooCommerce 忠诚度积分与奖励中的授权缺失/访问控制失效 免责声明： 本仓库仅用于教育目的及负责任的披露 。该漏洞已向厂商报告并获得修复。请勿利用此信息在未经授权的情况下攻击系统。 摘要 在 WooCommerce 的 MyRewards（WooRewards） 插件（版本 mSource-write$data; 业务影响 经济损失： 通过操纵“订单金额”积分倍数，攻击者可生成无限奖励积分，并将其兑换为高价值折扣券或免费商品，绕过电商支付网关。 权限提升： 普通客户（订阅者）可执行插件管理操作。 数据完整性受损：...

hdwebmobile-photo-video-reviews

Reseñas de Fotos y Videos de HDWebmobile Un plugin de WooCommerce que permite a los clientes adjuntar fotos y videos cortos a sus reseñas de productos, mostrados directamente en la lista de reseñas en la página del producto. WordPress.org:...