CVE-2025-1661

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.6.5 via the 'template' parameter of the wooftextsearch AJAX action. This makes it possible for unauthenticated attackers to include and...

Exploit for Missing Authorization in Directsoftware Order_Attachments_For_Woocommerce

🚀 WooCommerce Arbitrary File Upload Exploit CVE-2024-9756...

CVE-2024-13359

The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the addproductinputfieldstoorderitemmeta function in all versions up to, and including, 1.12.0. This may make it possible for unauthenticated attackers...

CVE-2024-13640

The Print Invoice & Delivery Notes for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.4.1 via the 'wcdn/invoice' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in...

CVE-2024-13774

The Wishlist for WooCommerce: Multi Wishlists Per Customer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.7. This is due to missing or incorrect nonce validation on the 'savetomultiplewishlist' function. This makes it possible for...

VulnCheck KEV: CVE-2025-1661

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.6.5 via the 'template' parameter of the wooftextsearch AJAX action. This makes it possible for unauthenticated attackers to include and...

CVE-2025-1363

The URL Shortener | Conversion Tracking | AB Testing | WooCommerce WordPress plugin through 9.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is...

CVE-2025-1362

The URL Shortener | Conversion Tracking | AB Testing | WooCommerce WordPress plugin through 9.0.2 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting customers via CSRF attacks...

CVE-2025-1362

CVE-2025-1362 affects the WordPress plugin URL Shortener | Conversion Tracking | AB Testing | WooCommerce (≤ 9.0.2). The root cause is missing CSRF checks in certain bulk actions, enabling an attacker with user login who can trick an admin into performing unintended actions (e.g., deleting custom...

CVE-2025-1362 easy-broken-link-checker <= 9.0.2 - Bulk Actions via CSRF

The URL Shortener | Conversion Tracking | AB Testing | WooCommerce WordPress plugin through 9.0.2 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting customers via CSRF attacks...

CVE-2024-13359

The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the addproductinputfieldstoorderitemmeta function in all versions up to, and including, 1.12.0. This may make it possible for unauthenticated attackers...

CVE-2024-13359 Product Input Fields for WooCommerce <= 1.12.0 - Unauthenticated Limited File Upload

The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the addproductinputfieldstoorderitemmeta function in all versions up to, and including, 1.12.0. This may make it possible for unauthenticated attackers...

CVE-2024-13359

CVE-2024-13359 affects Product Input Fields for WooCommerce (WordPress). All versions up to and including 1.12.0 are vulnerable to unauthenticated arbitrary file uploads due to insufficient file-type validation in add_product_input_fields_to_order_item_meta(). By default only double-extension upl...

CVE-2024-13359 Product Input Fields for WooCommerce <= 1.12.0 - Unauthenticated Limited File Upload

The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the addproductinputfieldstoorderitemmeta function in all versions up to, and including, 1.12.0. This may make it possible for unauthenticated attackers...

CVE-2024-13640

CVE-2024-13640 affects the WordPress plugin Print Invoice & Delivery Notes for WooCommerce. All versions up to 5.4.1 are vulnerable via the wcdn/invoice directory, enabling unauthenticated attackers to access sensitive data stored under /wp-content/uploads/wcdn/invoice (potential invoice files if...

WordPress Product Input Fields for WooCommerce plugin <= 1.12.0 - Unauthenticated Limited File Upload vulnerability

Unauthenticated Limited File Upload vulnerability discovered by luckybuddy in WordPress Plugin Product Input Fields for WooCommerce versions = 1.12.0...

CVE-2024-13774

The Wishlist for WooCommerce: Multi Wishlists Per Customer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.7. This is due to missing or incorrect nonce validation on the 'savetomultiplewishlist' function. This makes it possible for...

WordPress Print Invoice & Delivery Notes for WooCommerce plugin <= 5.4.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory vulnerability

Unauthenticated Sensitive Information Exposure Through Unprotected Directory vulnerability discovered by Tim Coen in WordPress Plugin Print Invoice & Delivery Notes for WooCommerce versions = 5.4.1...

CVE-2024-13774 Wishlist for WooCommerce: Multi Wishlists Per Customer <= 3.1.7 - Cross-Site Request Forgery to Cross-Site Scriping via Wishlist Name

The Wishlist for WooCommerce: Multi Wishlists Per Customer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.7. This is due to missing or incorrect nonce validation on the 'savetomultiplewishlist' function. This makes it possible for...

WordPress Wishlist for WooCommerce: Multi Wishlists Per Customer plugin <= 3.1.7 - Cross-Site Request Forgery to Cross-Site Scriping via Wishlist Name vulnerability

Cross-Site Request Forgery to Cross-Site Scriping via Wishlist Name vulnerability discovered by Tim Coen in WordPress Plugin Wishlist for WooCommerce versions = 3.1.7...