CVE-2021-34646

The CVE-2021-34646 vulnerability affects Booster for WooCommerce (WordPress plugin) up to version 5.4.3. It enables authentication bypass via process_email_verification due to a weak random token in reset_and_mail_activation_link within includes/class-wcj-emails-verification.php. This allows an a...

CVE-2024-1054

CVE-2024-1054 (Booster for WooCommerce, WordPress) is a Stored Cross-Site Scripting vulnerability in the Booster for WooCommerce plugin’s wcj_product_barcode shortcode. Exploitation requires authentication at contributor level or higher, and affects all versions up to 7.1.6. The issue stems from ...

CVE-2023-40002

CVE-2023-40002 concerns the Booster for WooCommerce WordPress plugin. Affected: Booster for WooCommerce plugin versions

CVE-2023-48747

CVE-2023-48747 affects Booster for WooCommerce (WordPress plugin)

CVE-2024-1534

CVE-2024-1534 affects Booster for WooCommerce (WordPress). The vulnerability is a Stored Cross-Site Scripting (XSS) in shortcode handling due to insufficient input sanitization and output escaping on user-supplied attributes. Affected versions are up to 7.1.7; exploitation requires contributor+ p...

CVE-2023-48333

CVE-2023-48333 affects Booster for WooCommerce (WordPress plugin by Pluggabl LLC) up to version 7.1.1, where an unauthorized actor with subscriber-level access could exfiltrate order information due to a missing capability check (init_atts). CVSS v3.1 base score 6.5 (Medium) with Confidentiality ...

CVE-2024-13744

The Booster for WooCommerce plugin (WordPress) is affected by CVE-2024-13744. Versions 4.0.1–7.2.4 are vulnerable due to missing file type validation in the validate_product_input_fields_on_add_to_cart function, enabling unauthenticated attackers to upload arbitrary files to the server and potent...

CVE-2023-52234

CVE-2023-52234 refers to Booster Elite for WooCommerce. Patchstack confirms vulnerable versions are

CVE-2022-4227

The CVE-2022-4227 entry concerns the Booster for WooCommerce family of WordPress plugins. Affected components: Booster for WooCommerce (pre-5.6.3), Booster Plus for WooCommerce (pre-6.0.0), and Booster Elite for WooCommerce (pre-6.0.0). Root cause: these plugins do not escape certain URLs and par...

CVE-2022-3763

The CVE-2022-3763 issue affects Booster for WooCommerce, Booster Plus for WooCommerce, and Booster Elite for WooCommerce plugins for WordPress. The root cause is the absence of a CSRF check when deleting files uploaded at checkout, enabling an authenticated attacker (a logged-in shop manager or a...

CVE-2024-29760

CVE-2024-29760 is a Reflected XSS in Booster for WooCommerce (Pluggabl LLC) caused by improper neutralization of input during web page generation. Affected: Booster for WooCommerce from baseline (n/a) up to 7.1.7. Potential impact includes execution of scripts in the user’s browser when they inte...

CVE-2022-41805

CVE-2022-41805 affects Booster for WooCommerce plugin versions 5.6.6, specifically at least 5.6.7, as recommended by multiple sources. If updating is not possible, monitor for official mitigations in patches. It is not stated whether this CVE has known in-the-wild exploits within the provided do...

CVE-2024-1986

The CVE-2024-1986 entry concerns Booster Elite for WooCommerce (WordPress). The vulnerability is an arbitrary file upload flaw in wc_add_new_product() across all versions up to 7.1.7, enabling network-authenticated (Subscriber+) attackers to upload arbitrary files when product-upload is enabled, ...

CVE-2024-3957

Booster for WooCommerce (CVE-2024-3957) allows unauthenticated arbitrary shortcode execution in versions up to 7.1.8. Wordfence notes the issue as a patched vulnerability, with CVSS v3.1 base score 7.3 (HIGH) and no user interaction required. Connected documents confirm the affected software and ...

CVE-2024-9239

CVE-2024-9239: Booster for WooCommerce (WordPress)

CVE-2018-20966

The CVE-2018-20966 entry documents a cross-site scripting (XSS) vulnerability in the WordPress plugin Woocommerce Jetpack before version 3.8.0, specifically in the Products Per Page feature. Affected software: woocommerce-jetpack plugin for WordPress. Root cause: lack of proper validation of clie...

CVE-2022-3762

The CVE-2022-3762 entry describes a vulnerability in the Booster for WooCommerce family of WordPress plugins (Booster for WooCommerce before 5.6.7, Booster Plus before 5.6.5, Booster Elite before 1.1.7) where modules do not validate files to download, enabling ShopManager and Admin to download ar...

CVE-2024-9170

CVE-2024-9170 (Booster for WooCommerce) is a stored cross-site scripting vulnerability in the Booster for WooCommerce WordPress plugin, affecting all versions up to and including 7.2.3. The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the wc...

CVE-2022-4016

The CVE-2022-4016 issue affects Booster for WooCommerce, Booster Plus for WooCommerce, and Booster Elite for WooCommerce WordPress plugins (versions prior to 5.6.7, 5.6.6, and 1.1.8 respectively). The vulnerability is a CSRF flaw in the creation and deletion of Customer roles, which could allow a...

CVE-2023-52231

CVE-2023-52231 affects Booster Plus for WooCommerce (WordPress). Root cause: missing authorization check allows unauthorized access to order information in versions prior to 7.1.2. Impact per available data: information disclosure of order data to unauthorized actors; CVSS base score 6.5 (Medium)...

CVE-2023-52232

CVE-2023-52232 : Booster Plus for WooCommerce (WordPress) prior to 7.1.2 has a Missing Authorization vulnerability (root cause: missing capability check) that allows an authenticated attacker to delete arbitrary posts/pages. Documented in Patchstack as Arbitrary Content Deletion with subscriber-l...

CVE-2021-25000

CVE-2021-25000 affects the Booster for WooCommerce WordPress plugin prior to 5.4.9. The vulnerability is a reflected Cross-Site Scripting (XSS) caused by not sanitising/escaping the wcj_delete_role parameter before output in the admin dashboard when the General module is enabled. Evidence across ...

CVE-2023-52230

CVE-2023-52230 affects Booster Plus for WooCommerce, where versions prior to 7.1.3 expose an authenticated arbitrary WordPress option disclosure due to missing authorization. The issue is a missing authorization vulnerability that could allow a user with at least subscriber privileges to view or ...

CVE-2024-12278

CVE-2024-12278 arises in the Booster for WooCommerce WordPress plugin. Connected sources confirm an unauthenticated Stored Cross-Site Scripting flaw caused by insufficient input sanitization/escaping, affecting Booster for WooCommerce versions up to 7.2.4 (per Wordfence) with a CVSS v3 score of 7...

CVE-2023-5638

CVE-2023-5638 concerns the Booster for WooCommerce WordPress plugin. The vulnerability is a Stored XSS via the wcj_image shortcode, triggered by insufficient input sanitization and output escaping on shortcode attributes. Affected versions are up to and including 7.1.2. Exploitation requires the ...

CVE-2022-4017

The CVE-2022-4017 entries cover multiple Booster for WooCommerce plugins (Booster, Booster Plus, Booster Elite) for WordPress, with versions prior to 6.0.1 vulnerable due to flawed or missing CSRF checks in numerous places. This CSRF weakness could permit logged-in users to perform unintended act...

CVE-2024-13708

Booster for WooCommerce (WordPress) is affected by an unauthenticated stored XSS via SVG uploads in versions 4.0.1–7.2.4 due to insufficient input sanitization and output escaping. The issue can allow arbitrary script execution in pages when SVGs are loaded by users. Wordfence notes the vulnerabi...

CVE-2023-4796

CVE-2023-4796 affects the Booster for WooCommerce plugin for WordPress (versions up to 7.1.0). It is an information-disclosure vulnerability via the wcj_wp_option shortcode, allowing authenticated users with subscriber-level capabilities or higher to retrieve arbitrary sensitive site options. The...

CVE-2021-24999

CVE-2021-24999 concerns the Booster for WooCommerce WordPress plugin, up to version 5.4.8. The vulnerability is a reflected Cross-Site Scripting in the Pdf Invoicing module, where the wcj_notice parameter is not properly sanitised/escaped before being output in the admin dashboard. Affected compo...

CVE-2021-25001

CVE-2021-25001 affects the WordPress Booster for WooCommerce plugin (versions before 5.4.9). Multiple connected sources confirm a vulnerability in the Product XML Feeds module: the wcj_create_products_xml_result parameter is not sanitised/escaped when output in the admin dashboard, enabling a ref...

CVE-2023-4945

CVE-2023-4945 — Booster for WooCommerce (WordPress) Stored XSS Vulnerability: Stored XSS via multiple shortcode attributes in Booster for WooCommerce, affecting versions

CVE-2023-51511

CVE-2023-51511 involves Booster Elite for WooCommerce (Pluggabl LLC) with an improper authentication vulnerability that allows accessing functionality not properly constrained by ACLs. Affected software: Booster Elite for WooCommerce prior to version 7.1.3. Public references indicate a base CVSS ...

CVE-2025-39446

CVE-2025-39446 is a reflected XSS vulnerability in Booster Plus for WooCommerce (Pluggabl LLC) up to version 7.2.4. The issue stems from improper input neutralization during web page generation and can enable a reflected cross-site scripting attack. Public references in Patchstack and PT Security...

CVE-2024-13342

The Booster for WooCommerce plugin (WordPress) is vulnerable to arbitrary file uploads due to missing file type validation in the add_files_to_order function, affecting all versions up to and including 7.2.4. This allows unauthenticated attackers to upload arbitrary files with double extensions o...

CVE-2025-64196

The CVE-2025-64196 entry describes a Cross-Site Scripting (Reflected XSS) vulnerability in the Booster for WooCommerce plugin’s WordPress component (woocommerce-jetpack) affecting version range up to and including 7.2.5. The root cause is improper neutralization of input during web page generatio...

CVE-2025-64380

CVE-2025-64380 affects WordPress Booster for WooCommerce (woocommerce-jetpack) plugin, specifically versions up to and including 7.3.2. The root cause is improper input handling during web page generation, leading to a stored cross-site scripting (XSS) vulnerability. This means malicious script p...

CVE-2025-64379

CVE-2025-64379 affects Booster for WooCommerce (WordPress plugin powering the WooCommerce extension) up to version 7.4.0. The root cause is missing/incorrectly configured access control security levels, enabling a broken/misconfigured authorization vulnerability. Impact is potential improper acce...