Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 222

CVE-2025-13339

Hippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Read

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.7.1 via the template_redirect() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

CVSS 3.1 · 7.5 High EPSS 2.4% KEV · Not listed
Vendors
Hippooo Woocommerce Wordpress
Products
Hippoo Mobile App For Woocommerce Woocommerce Wordpress
CVE-2025-12895

Kalium <= 3.29 - Missing Authorization to Unauthenticated Mail Relay via kalium_vc_contact_form_request

The Kalium 3 | Creative WordPress & WooCommerce Theme theme for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the kalium_vc_contact_form_request() function in all versions up to, and including, 3.29. This makes it possible for unauthenticated attackers to use the theme an an open mail relay and send email to arbitrary email addresses on the server's behalf.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Laborator Woocommerce Wordpress
Products
Kalium Woocommerce Wordpress
CVE-2025-15260

MyRewards – Loyalty Points and Rewards for WooCommerce <= 5.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Loyalty Rule Modification

The MyRewards – Loyalty Points and Rewards for WooCommerce plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 5.6.1. This is due to the plugin not properly verifying that a user is authorized to perform an action in the 'ajax' function. This makes it possible for authenticated attackers, with subscriber level access and above, to modify, add, or delete loyalty program earning rules, including manipulating point multipliers to arbitrary values.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Lwsdevelopers Woocommerce Wordpress
Products
Myrewards Woocommerce Wordpress
CVE-2025-10484

Registration & Login with Mobile Phone Number for WooCommerce <= 1.3.1 - Authentication Bypass

The Registration & Login with Mobile Phone Number for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.3.1. This is due to the plugin not properly verifying a users identity prior to authenticating them via the fma_lwp_set_session_php_fun() function. This makes it possible for unauthenticated attackers to authenticate as any user on the site, including administrators, without a valid password.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Fmeaddons Woocommerce Wordpress
Products
Registration And Login With Mobile Phone Number For Woocommerce Woocommerce Wordpress
CVE-2025-10191

Big Post Shipping for WooCommerce <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Big Post Shipping for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wooboigpost_shipping_status' shortcode in all versions up to, and including, 2.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Fusedsoftware Woocommerce Wordpress
Products
Big Post Shipping For Woocommerce Woocommerce Wordpress
CVE-2025-10862

Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers <= 2.1.3 - Unauthenticated SQL Injection via 'id'

The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 2.1.3. This is due to insufficient escaping on the 'id' parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Roxnor Woocommerce Wordpress
Products
Popup Builder Woocommerce Wordpress
CVE-2025-10861

Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers <= 2.1.4 - Unauthenticated Server-Side Request Forgery

The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.1.4. This is due to insufficient validation on the URLs supplied via the URL parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services, as well as conduct network reconnaissance. The vulnerability was partially patched in version 2.1.4.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Popup Builder Roxnor Woocommerce and 1 more
Products
Popup Builder Popup Builder Woocommerce and 1 more
CVE-2025-12123

Customer Reviews Collector for WooCommerce <= 4.6.1 - Reflected Cross-Site Scripting

The Customer Reviews Collector for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'email-text' parameter in all versions up to, and including, 4.6.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Trustindex Woocommerce Wordpress
Products
Customer Reviews Collector For Woocommerce Woocommerce Wordpress
CVE-2025-11888

ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution <= 4.8.4 - Incorrect Authorization to Authenticated (Editor+) License Status Update

The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient capability check on the post_deactive() function and post_activate() function in all versions up to, and including, 4.8.4. This makes it possible for authenticated attackers, with Editor-level access and above, to activate and deactivate licenses.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Elementor Roxnor Woocommerce and 1 more
Products
Elementor Shopengine Elementor Woocommerce Builder Addon Woocommerce and 1 more
CVE-2025-11890

Crypto Payment Gateway with Payeer for WooCommerce <= 1.0.3 - Unauthenticated Payment Bypass

The Crypto Payment Gateway with Payeer for WooCommerce plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 1.0.3. This is due to the plugin not properly verifying a payments status through server-side validation though the /wc-api/bp-payeer-gateway-callback endpoint. This makes it possible for unauthenticated attackers to update unpaid order statuses to paid resulting in a loss of revenue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Beycanpress Woocommerce Wordpress
Products
Crypto Payment Gateway With Payeer For Woocommerce Woocommerce Wordpress
CVE-2025-12392

Cryptocurrency Payment Gateway for WooCommerce <= 2.0.25 - Missing Authorization to Unauthenticated Tracking Status Update

The Cryptocurrency Payment Gateway for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'handle_optin_optout' function in all versions up to, and including, 2.0.25. This makes it possible for unauthenticated attackers to opt in and out of tracking.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Tripleatechnology Woocommerce Wordpress
Products
Cryptocurrency Payment Gateway For Woocommerce Woocommerce Wordpress
CVE-2025-12040

Wishlist for WooCommerce <= 1.1.3 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation

The Wishlist for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.3 via several functions in class-th-wishlist-frontend.php due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to modify other user's wishlists

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Themehunk Woocommerce Wordpress
Products
Wishlist For Woocommerce Woocommerce Wordpress
CVE-2025-12358

ShopEngine <= 4.8.5 - Cross-Site Request Forgery to Wishlist Manipulation

The ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.8.5. This is due to missing nonce validation on the "post_add_to_list" function as well as an incorrect permissions callback in the "Api/init" function. This makes it possible for unauthenticated attackers to add or remove products from a user's wishlist via a forged request granted they can trick a site's user into performing an action such as clicking on a link.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Elementor Roxnor Woocommerce and 1 more
Products
Elementor Shopengine Elementor Woocommerce Builder Addon Woocommerce and 1 more
CVE-2025-6730

Bonanza – WooCommerce Free Gifts Lite <= 1.0.0 - Missing Authorization to Authenticated (Subscriber+) Opt In Success

The Bonanza – WooCommerce Free Gifts Lite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the xlo_optin_call() function in all versions up to, and including, 1.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to set the opt in status to success.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Woocommerce Wordpress
Products
Woocommerce Wordpress
CVE-2025-11821

Woocommerce – Products By Custom Tax <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Woocommerce – Products By Custom Tax plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'woo_products_custom_tax' shortcode in all versions up to, and including, 2.2. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Elvismdev Woocommerce Wordpress
Products
Products By Custom Tax Woocommerce Wordpress
CVE-2025-12964

Magical Products Display <= 1.1.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via MPD Pricing Table Widget

The Magical Products Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mpdpr_title_tag' and 'mpdpr_subtitle_tag' parameters in the MPD Pricing Table widget in all versions up to, and including, 1.1.29 due to insufficient input sanitization and output escaping on user-supplied HTML tag names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Nalam-1 Woocommerce Wordpress
Products
Magical Products Display Woocommerce Wordpress
CVE-2025-12584

Quick View for WooCommerce <= 2.2.17 - Unauthenticated Private Product Disclosure

The Quick View for WooCommerce plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.17 via the 'wqv_popup_content' AJAX endpoint due to insufficient restrictions on which products can be included. This makes it possible for unauthenticated attackers to extract data from private products that they should not have access to.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Shapedplugin Woocommerce Wordpress
Products
Quick View Woocommerce Wordpress
CVE-2025-14165

Kirim.Email WooCommerce Integration <= 1.2.9 - Cross-Site Request Forgery to Settings Update

The Kirim.Email WooCommerce Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.9. This is due to missing nonce validation on the plugin's settings page. This makes it possible for unauthenticated attackers to modify the plugin's API credentials and integration settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Developerke Woocommerce Wordpress
Products
Kirim.email Woocommerce Integration Woocommerce Wordpress
CVE-2025-14054

WC Builder <= 1.2.0 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'heading_color' Shortcode Attribute

The WC Builder – WooCommerce Page Builder for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'heading_color' parameter (and multiple other styling parameters) of the `wpbforwpbakery_product_additional_information` shortcode in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Hasthemes Woocommerce Wordpress
Products
Wc Builder Woocommerce Wordpress
CVE-2025-14059

EmailKit <= 1.6.1 - Authenticated (Author+) Arbitrary File Read via Path Traversal

The EmailKit plugin for WordPress is vulnerable to Arbitrary File Read via Path Traversal in all versions up to, and including, 1.6.1. This is due to missing path validation in the create_template REST API endpoint where user-controlled input from the emailkit-editor-template parameter is passed directly to file_get_contents() without sanitization. This makes it possible for authenticated attackers with Author-level permissions or higher to read arbitrary files on the server, including sensitive configuration files like /etc/passwd and wp-config.php, via the REST API. The file contents are stored in post meta and can be exfiltrated through MetForm's email confirmation feature.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Roxnor Woocommerce Wordpress
Products
Emailkit Woocommerce Wordpress