Is my WordPress plugin safe?

• Sep 10, 2026Ultimate Gift Cards for WooCommerce: Does not have any authorisation checkCVE-2026-19439 · fixed in 3.2.10 · reported by WPScanHigh 7.5

  The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not have any authorisation check when displaying gift card details, allowing unauthenticated users to retrieve the gift cards attached to arbitrary orders and disclose customer personal data, balances, dates and, in 3.2.9, the live redemption code, which anyone holding it can spend. Versions from 3.0.3 to 3.2.8 disclose the same data without the redemption code.

  NVD recordwpscan.com

• Sep 10, 2026Ultimate Gift Cards for WooCommerce: Does not reconcile the value of the gift card coupon it issues against the amount actually collected at checkoutCVE-2026-19436 · fixed in 3.2.10 · reported by WPScanHigh 7.5

  The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not reconcile the value of the gift card coupon it issues against the amount actually collected at checkout, allowing unauthenticated users to obtain store credit worth more than they paid.

  NVD recordwpscan.com

• Sep 9, 2026Ultimate Gift Cards for WooCommerce: Does not verify that the user redeeming a gift card is its intended recipientCVE-2026-75861 · fixed in 3.2.10 · reported by WPScanMedium 6.5

  The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not verify that the user redeeming a gift card is its intended recipient, allowing any authenticated user, such as a subscriber, to redeem gift cards belonging to other users, zeroing their balance and crediting the value to themselves. In 3.2.9 an ownership check was added on one of the two affected redemption paths; the one that remains requires a companion Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 from the same vendor to be active.

  NVD recordwpscan.com

• Sep 2, 2026Unauthenticated Broken Access Control in Ultimate Gift Cards For WooCommerce <= 3.2.9 versions.CVE-2026-84760 · affects up to 3.2.9 · reported by PatchstackMedium 5.3

  Unauthenticated Broken Access Control in Ultimate Gift Cards For WooCommerce <= 3.2.9 versions.

  NVD recordpatchstack.com

• Feb 19, 2026Ultimate Gift Cards For WooCommerce: Missing AuthorizationCVE-2026-24375 · affects up to 3.2.4 · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in WP Swings Ultimate Gift Cards For WooCommerce woo-gift-cards-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Gift Cards For WooCommerce: from n/a through <= 3.2.4.

  NVD recordpatchstack.com

• Jun 3, 2025Ultimate Gift Cards for WooCommerce: Boolean-based SQL InjectionCVE-2025-5103 · affects up to 3.1.4 · reported by WordfenceMedium 4.9

  The Ultimate Gift Cards for WooCommerce plugin for WordPress is vulnerable to boolean-based SQL Injection via the 'default_price' and 'product_id' parameters in all versions up to, and including, 3.1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

  NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jan 8, 2025The Ultimate Gift Cards for WooCommerce – Create WooCommerce Gift Cards, Gift Vouchers, Redeem & Manage Digital Gift Coupons.CVE-2024-11423 · affects up to 3.0.6 · reported by WordfenceHigh 7.5

  The Ultimate Gift Cards for WooCommerce – Create WooCommerce Gift Cards, Gift Vouchers, Redeem & Manage Digital Gift Coupons. Offer Gift Certificates, Schedule Gift Cards, and Use Advance Coupons With Personalized Templates plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several REST API endpoints such as /wp-json/gifting/recharge-giftcard in all versions up to, and including, 3.0.6. This makes it possible for unauthenticated attackers to recharge a gift card balance, without making a payment along with reducing gift card balances without purchasing anything.

  NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Mar 16, 2024Ultimate Gift Cards for WooCommerce – Create, Redeem & Manage Digital Gift Certificates with Personalized Templates: Sensitive Information ExposureCVE-2024-1857 · affects up to 2.6.6 · reported by WordfenceMedium 5.3

  The Ultimate Gift Cards for WooCommerce – Create, Redeem & Manage Digital Gift Certificates with Personalized Templates plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.6 via the wps_wgm_preview_email_template(). This makes it possible for unauthenticated attackers to read password protected and draft posts that may contain sensitive data.

  NVD recordplugins.trac.wordpress.orgwordfence.com

• Jul 1, 2023Ultimate Gift Cards for WooCommerce: Cross-Site Request ForgeryCVE-2021-4391 · affects up to 2.1.1 · reported by WordfenceMedium 4.3

  The Ultimate Gift Cards for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1.1. This is due to missing or incorrect nonce validation on the mwb_wgm_save_post() function. This makes it possible for unauthenticated attackers to modify product gift card details via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  NVD recordblog.nintechnet.comblog.nintechnet.com

Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.