Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,766 results · page 20 of 56
Dec 19, 2025File Uploader for WooCommerce: Arbitrary file uploadsCVE-2025-13329 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The File Uploader for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the callback function for the 'add-image-data' REST API endpoint in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to upload arbitrary files to the Uploadcare service and subsequently download them on the affected site's server which may make remote code execution possible.
- Product
- File Uploader for WooCommerce
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update File Uploader for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Dec 18, 2025HUSKY – Products Filter Professional for WooCommerce: Insecure Direct Object ReferenceCVE-2025-13110 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.7.3 via the "woof_add_subscr" function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber level access and above, to create product messenger subscriptions on behalf of arbitrary users, including administrators.
- Product
- HUSKY – Products Filter Professional for WooCommerce
- Affected
- up to 1.3.7.3
- What to do
- Affects up to 1.3.7.3. Update HUSKY – Products Filter Professional for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 18, 2025WooCommerce Recover Abandoned Cart: Missing AuthorizationCVE-2025-64222 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in FantasticPlugins WooCommerce Recover Abandoned Cart rac allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Recover Abandoned Cart: from n/a through <= 24.6.0.
- Product
- WooCommerce Recover Abandoned Cart
- Affected
- up to 24.6.0
- What to do
- Affects up to 24.6.0. Update WooCommerce Recover Abandoned Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025PDF Invoice Builder for WooCommerce: Deserialization of Untrusted DataCVE-2025-60083 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in add-ons.org PDF Invoice Builder for WooCommerce pdf-for-woocommerce allows Object Injection.This issue affects PDF Invoice Builder for WooCommerce: from n/a through <= 6.5.0.
- Product
- PDF Invoice Builder for WooCommerce
- Affected
- up to 6.5.0
- What to do
- Affects up to 6.5.0. Update PDF Invoice Builder for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025Advance Seat Reservation Management for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-58951 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in smartcms Advance Seat Reservation Management for WooCommerce scw-seat-reservation allows SQL Injection.This issue affects Advance Seat Reservation Management for WooCommerce: from n/a through <= 3.1.
- Product
- Advance Seat Reservation Management for WooCommerce
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Advance Seat Reservation Management for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025Custom Fields Account Registration For Woocommerce: Incorrect Privilege AssignmentCVE-2025-49379 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Incorrect Privilege Assignment vulnerability in silverplugins217 Custom Fields Account Registration For Woocommerce custom-fields-account-registration-for-woocommerce allows Privilege Escalation.This issue affects Custom Fields Account Registration For Woocommerce: from n/a through <= 1.2.
- Product
- Custom Fields Account Registration For Woocommerce
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Custom Fields Account Registration For Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025TI WooCommerce Wishlist: Missing AuthorizationCVE-2025-67929 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TI WooCommerce Wishlist: from n/a through <= 2.10.0.
- Product
- TI WooCommerce Wishlist
- Affected
- up to 2.10.0
- What to do
- Affects up to 2.10.0. Update TI WooCommerce Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Sendinblue for WooCommerce: Missing AuthorizationCVE-2025-66128 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Brevo Sendinblue for WooCommerce woocommerce-sendinblue-newsletter-subscription allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sendinblue for WooCommerce: from n/a through <= 4.0.49.
- Product
- Sendinblue for WooCommerce
- Affected
- up to 4.0.49
- What to do
- Affects up to 4.0.49. Update Sendinblue for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025OnPay.io for WooCommerce: Missing AuthorizationCVE-2025-64638 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in OnPay.io OnPay.io for WooCommerce onpay-io-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects OnPay.io for WooCommerce: from n/a through <= 1.0.47.
- Product
- OnPay.io for WooCommerce
- Affected
- up to 1.0.47
- What to do
- Affects up to 1.0.47. Update OnPay.io for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025WCFM – Frontend Manager for WooCommerce: Missing AuthorizationCVE-2025-54004 · WordPress plugins & themes · reported by PatchstackLow 2.7
Missing Authorization vulnerability in WC Lovers WCFM – Frontend Manager for WooCommerce wc-frontend-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM – Frontend Manager for WooCommerce: from n/a through <= 6.7.24.
- Product
- WCFM – Frontend Manager for WooCommerce
- Affected
- up to 6.7.24
- What to do
- Affects up to 6.7.24. Update WCFM – Frontend Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2025TI WooCommerce Wishlist: HTML InjectionCVE-2025-9207 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The TI WooCommerce Wishlist plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 2.10.0. This is due to the plugin accepting hidden fields and not limiting the values or data that can input and is later output. This makes it possible for unauthenticated attackers to inject arbitrary HTML into wishlist items.
- Product
- TI WooCommerce Wishlist
- Affected
- up to 2.10.0
- What to do
- Affects up to 2.10.0. Update TI WooCommerce Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 13, 2025YITH WooCommerce Quick View: Stored Cross-Site ScriptingCVE-2025-8617 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The YITH WooCommerce Quick View plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's yith_quick_view shortcode in all versions up to, and including, 2.7.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- YITH WooCommerce Quick View
- Affected
- up to 2.7.0
- What to do
- Affects up to 2.7.0. Update YITH WooCommerce Quick View to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 13, 2025افزونه پیامک ووکامرس فوق حرفه ای (جدید) payamito sms woocommerce: Time-based blind SQL InjectionCVE-2025-13077 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The افزونه پیامک ووکامرس فوق حرفه ای (جدید) payamito sms woocommerce plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'columns' parameter in all versions up to, and including, 1.3.5. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- افزونه پیامک ووکامرس فوق حرفه ای (جدید) payamito sms woocommerce
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update افزونه پیامک ووکامرس فوق حرفه ای (جدید) payamito sms woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordowasp.orgplugins.trac.wordpress.org
Dec 12, 2025FunnelKit - Funnel Builder for WooCommerce Checkout: Time-based blind SQL InjectionCVE-2025-14169 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The FunnelKit - Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'opid' parameter in all versions up to, and including, 3.13.1.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- FunnelKit - Funnel Builder for WooCommerce Checkout
- Affected
- up to 3.13.1.5
- What to do
- Affects up to 3.13.1.5. Update FunnelKit - Funnel Builder for WooCommerce Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 12, 2025Hippoo Mobile App for WooCommerce: Arbitrary file writeCVE-2025-12655 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to arbitrary file write via a missing authorization check in all versions up to, and including, 1.7.1. This is due to the REST API endpoint `/wp-json/hippoo/v1/wc/token/save_callback/{token_id}` being registered with `permission_callback => '__return_true'`, which allows unauthenticated access. This makes it possible for unauthenticated attackers to write arbitrary JSON content to the server's publicly accessible upload directory via the vulnerable endpoint.
- Product
- Hippoo Mobile App for WooCommerce
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update Hippoo Mobile App for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 11, 2025Kirim.Email WooCommerce Integration: Cross-Site Request ForgeryCVE-2025-14165 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Kirim.Email WooCommerce Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.9. This is due to missing nonce validation on the plugin's settings page. This makes it possible for unauthenticated attackers to modify the plugin's API credentials and integration settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Kirim.Email WooCommerce Integration
- Affected
- up to 1.2.9
- What to do
- Affects up to 1.2.9. Update Kirim.Email WooCommerce Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 11, 2025Premmerce Wishlist for WooCommerce: Missing AuthorizationCVE-2025-13440 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Premmerce Wishlist for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.1.10. This is due to a missing capability check on the deleteWishlist() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary wishlists.
- Product
- Premmerce Wishlist for WooCommerce
- Affected
- up to 1.1.10
- What to do
- Affects up to 1.1.10. Update Premmerce Wishlist for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 11, 2025Product Filtering by Categories, Tags, Price Range for WooCommerce – Filter Plus: Unauthorized modification of dataCVE-2025-13314 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Product Filtering by Categories, Tags, Price Range for WooCommerce – Filter Plus plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.1.6 due to a missing capability check on the 'filter_save_settings' and 'add_filter_options' AJAX actions. This makes it possible for unauthenticated attackers to modify the plugin's settings and create arbitrary filter options.
- Product
- Product Filtering by Categories, Tags, Price Range for WooCommerce – Filter Plus
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update Product Filtering by Categories, Tags, Price Range for WooCommerce – Filter Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 11, 2025Campay Woocommerce Payment Gateway: Unauthenticated Payment BypassCVE-2025-12883 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Campay Woocommerce Payment Gateway plugin for WordPress is vulnerable to Unauthenticated Payment Bypass in all versions up to, and including, 1.2.2. This is due to the plugin not properly validating that a transaction has occurred through the payment gateway. This makes it possible for unauthenticated attackers to bypass payments and mark orders as successfully completed resulting in a loss of income.
- Product
- Campay Woocommerce Payment Gateway
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Campay Woocommerce Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Dec 11, 2025Premmerce Brands for WooCommerce: Unauthorized modification of dataCVE-2025-12783 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Premmerce Brands for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveBrandsSettings function in all versions up to, and including, 1.2.13. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify brand permalink settings.
- Product
- Premmerce Brands for WooCommerce
- Affected
- up to 1.2.13
- What to do
- Affects up to 1.2.13. Update Premmerce Brands for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 10, 2025Hippoo Mobile App for WooCommerce: Path TraversalCVE-2025-13339 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.7.1 via the template_redirect() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- Hippoo Mobile App for WooCommerce
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update Hippoo Mobile App for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 9, 2025Advanced Product Fields (Product Addons) for WooCommerce: Cross-Site Request ForgeryCVE-2025-13924 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.17. This is due to missing or incorrect nonce validation on the 'maybe_duplicate' function. This makes it possible for unauthenticated attackers to duplicate and publish product field groups, including draft and pending field groups, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Advanced Product Fields (Product Addons) for WooCommerce
- Affected
- up to 1.6.17
- What to do
- Affects up to 1.6.17. Update Advanced Product Fields (Product Addons) for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Dec 9, 2025WebToffee eCommerce Marketing Automation: Missing AuthorizationCVE-2025-67599 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WebToffee WebToffee eCommerce Marketing Automation decorator-woocommerce-email-customizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WebToffee eCommerce Marketing Automation: from n/a through <= 2.1.1.
- Product
- WebToffee eCommerce Marketing Automation
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update WebToffee eCommerce Marketing Automation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025WooCommerce PDF Invoices & Packing Slips: Missing AuthorizationCVE-2025-67589 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Overnight WooCommerce PDF Invoices & Packing Slips woocommerce-pdf-invoices-packing-slips allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce PDF Invoices & Packing Slips: from n/a through <= 4.9.1.
- Product
- WooCommerce PDF Invoices & Packing Slips
- Affected
- up to 4.9.1
- What to do
- Affects up to 4.9.1. Update WooCommerce PDF Invoices & Packing Slips to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Constant Contact + WooCommerce: Missing AuthorizationCVE-2025-67580 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Constant Contact Constant Contact + WooCommerce constant-contact-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Constant Contact + WooCommerce: from n/a through <= 2.4.1.
- Product
- Constant Contact + WooCommerce
- Affected
- up to 2.4.1
- What to do
- Affects up to 2.4.1. Update Constant Contact + WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Pixel Manager for WooCommerce: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-67564 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in alekv Pixel Manager for WooCommerce woocommerce-google-adwords-conversion-tracking-tag allows Retrieve Embedded Sensitive Data.This issue affects Pixel Manager for WooCommerce: from n/a through <= 1.51.1.
- Product
- Pixel Manager for WooCommerce
- Affected
- up to 1.51.1
- What to do
- Affects up to 1.51.1. Update Pixel Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Multi-Step Checkout for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67542 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SilkyPress Multi-Step Checkout for WooCommerce wp-multi-step-checkout allows DOM-Based XSS.This issue affects Multi-Step Checkout for WooCommerce: from n/a through <= 2.33.
- Product
- Multi-Step Checkout for WooCommerce
- Affected
- up to 2.33
- What to do
- Affects up to 2.33. Update Multi-Step Checkout for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Thank You Page Customizer for WooCommerce: Missing AuthorizationCVE-2025-66528 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Thank You Page Customizer for WooCommerce: from n/a through <= 1.1.8.
- Product
- Thank You Page Customizer for WooCommerce
- Affected
- up to 1.1.8
- What to do
- Affects up to 1.1.8. Update Thank You Page Customizer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Order Delivery Date for WooCommerce: Missing AuthorizationCVE-2025-63024 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in tychesoftwares Order Delivery Date for WooCommerce order-delivery-date-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Delivery Date for WooCommerce: from n/a through <= 4.3.1.
- Product
- Order Delivery Date for WooCommerce
- Affected
- up to 4.3.1
- What to do
- Affects up to 4.3.1. Update Order Delivery Date for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Payment Gateway for PayPal on WooCommerce: Missing AuthorizationCVE-2025-63023 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Easy Payment Payment Gateway for PayPal on WooCommerce woo-paypal-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment Gateway for PayPal on WooCommerce: from n/a through <= 9.0.53.
- Product
- Payment Gateway for PayPal on WooCommerce
- Affected
- up to 9.0.53
- What to do
- Affects up to 9.0.53. Update Payment Gateway for PayPal on WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025WooCommerce Payment Gateway - Paysera: Missing AuthorizationCVE-2025-63015 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in paysera WooCommerce Payment Gateway - Paysera woo-payment-gateway-paysera allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Payment Gateway - Paysera: from n/a through <= 3.10.0.
- Product
- WooCommerce Payment Gateway - Paysera
- Affected
- up to 3.10.0
- What to do
- Affects up to 3.10.0. Update WooCommerce Payment Gateway - Paysera to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025MultiParcels Shipping For WooCommerce: Missing AuthorizationCVE-2025-62995 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in multiparcels MultiParcels Shipping For WooCommerce multiparcels-shipping-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MultiParcels Shipping For WooCommerce: from n/a through <= 1.30.12.
- Product
- MultiParcels Shipping For WooCommerce
- Affected
- up to 1.30.12
- What to do
- Affects up to 1.30.12. Update MultiParcels Shipping For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Eupago Gateway For Woocommerce: Missing AuthorizationCVE-2025-62870 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Eupago Eupago Gateway For Woocommerce eupago-gateway-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eupago Gateway For Woocommerce: from n/a through <= 4.7.1.
- Product
- Eupago Gateway For Woocommerce
- Affected
- up to 4.7.1
- What to do
- Affects up to 4.7.1. Update Eupago Gateway For Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Virtuaria PagBank / PagSeguro para Woocommerce: Missing AuthorizationCVE-2025-62151 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Virtuaria Virtuaria PagBank / PagSeguro para Woocommerce virtuaria-pagseguro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Virtuaria PagBank / PagSeguro para Woocommerce: from n/a through <= 3.6.3.
- Product
- Virtuaria PagBank / PagSeguro para Woocommerce
- Affected
- up to 3.6.3
- What to do
- Affects up to 3.6.3. Update Virtuaria PagBank / PagSeguro para Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Arbitrary shortcode executionCVE-2025-13642 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.16.7 due to insufficient input sanitization on the `type` parameter in the form preview functionality. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes via the `pp_preview_form` endpoint.
- Product
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
- Affected
- up to 4.16.7
- What to do
- Affects up to 4.16.7. Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 6, 2025Live Sales Notification for Woocommerce – Woomotiv: Reflected Cross-Site ScriptingCVE-2025-13137 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Live Sales Notification for Woocommerce – Woomotiv plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'woomotiv_limit' parameter in all versions up to, and including, 3.6.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Live Sales Notification for Woocommerce – Woomotiv
- Affected
- up to 3.6.3
- What to do
- Affects up to 3.6.3. Update Live Sales Notification for Woocommerce – Woomotiv to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Dec 6, 2025Search, Filters & Merchandising for WooCommerce: Unauthorized modification of dataCVE-2025-12091 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Search, Filters & Merchandising for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wcis_save_email' endpoint in all versions up to, and including, 3.0.67. This makes it possible for authenticated attackers, with Subscriber-level access and above, to deactivate the plugin.
- Product
- Search, Filters & Merchandising for WooCommerce
- Affected
- up to 3.0.67
- What to do
- Affects up to 3.0.67. Update Search, Filters & Merchandising for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 5, 2025WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors: Cross-Site Request ForgeryCVE-2025-12130 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.4. This is due to missing or incorrect nonce validation on the /vendor_dashboard/product/delete/ endpoint. This makes it possible for unauthenticated attackers to delete vendor products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors
- Affected
- up to 2.6.4
- What to do
- Affects up to 2.6.4. Update WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 5, 2025PDF Catalog for WooCommerce: Stored Cross-Site ScriptingCVE-2025-12191 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The PDF Catalog for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pdfcatalog' AJAX action in all versions up to, and including, 1.1.18 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- PDF Catalog for WooCommerce
- Affected
- up to 1.1.18
- What to do
- Affects up to 1.1.18. Update PDF Catalog for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Dec 4, 2025Omnichannel for WooCommerce: Google, Amazon, eBay & Walmart Integration – Powered by Codisto: Stored Cross-Site ScriptingCVE-2025-11727 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Omnichannel for WooCommerce: Google, Amazon, eBay & Walmart Integration – Powered by Codisto plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the sync() function in all versions up to, and including, 1.3.65 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Omnichannel for WooCommerce: Google, Amazon, eBay & Walmart Integration – Powered by Codisto
- Affected
- up to 1.3.65
- What to do
- Affects up to 1.3.65. Update Omnichannel for WooCommerce: Google, Amazon, eBay & Walmart Integration – Powered by Codisto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 3, 2025HUSKY – Products Filter Professional for WooCommerce: Insecure Direct Object ReferenceCVE-2025-13109 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.7.2 via the "woof_add_query" and "woof_remove_query" functions due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber level access and above, to insert or remove arbitrary saved search queries into any user's profile, including administrators.
- Product
- HUSKY – Products Filter Professional for WooCommerce
- Affected
- up to 1.3.7.2
- What to do
- Affects up to 1.3.7.2. Update HUSKY – Products Filter Professional for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 3, 2025ShopEngine Elementor WooCommerce Builder Addon: Cross-Site Request ForgeryCVE-2025-12358 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.8.5. This is due to missing nonce validation on the "post_add_to_list" function as well as an incorrect permissions callback in the "Api/init" function. This makes it possible for unauthenticated attackers to add or remove products from a user's wishlist via a forged request granted they can trick a site's user into performing an action such as clicking on a link.
- Product
- ShopEngine Elementor WooCommerce Builder Addon
- Affected
- up to 4.8.5
- What to do
- Affects up to 4.8.5. Update ShopEngine Elementor WooCommerce Builder Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 2, 2025Kadence WooCommerce Email Designer: Stored Cross-Site ScriptingCVE-2025-13387 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Kadence WooCommerce Email Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer name in all versions up to, and including, 1.5.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Kadence WooCommerce Email Designer
- Affected
- up to 1.5.17
- What to do
- Affects up to 1.5.17. Update Kadence WooCommerce Email Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 27, 2025Quick View for WooCommerce: Information ExposureCVE-2025-12584 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Quick View for WooCommerce plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.17 via the 'wqv_popup_content' AJAX endpoint due to insufficient restrictions on which products can be included. This makes it possible for unauthenticated attackers to extract data from private products that they should not have access to.
- Product
- Quick View for WooCommerce
- Affected
- up to 2.2.17
- What to do
- Affects up to 2.2.17. Update Quick View for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 27, 2025Hide Category by User Role for WooCommerce: Missing AuthorizationCVE-2025-13441 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Hide Category by User Role for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.3.1. This is due to a missing capability check on the admin_init hook that executes wp_cache_flush(). This makes it possible for unauthenticated attackers to flush the site's object cache via forged requests, potentially degrading site performance.
- Product
- Hide Category by User Role for WooCommerce
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update Hide Category by User Role for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 27, 2025QODE Wishlist for WooCommerce: Insecure Direct Object ReferenceCVE-2025-13157 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The QODE Wishlist for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.7 via the 'qode_wishlist_for_woocommerce_wishlist_table_item_callback' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to update the public view of arbitrary wishlists.
- Product
- QODE Wishlist for WooCommerce
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update QODE Wishlist for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 27, 2025Customer Reviews Collector for WooCommerce: Reflected Cross-Site ScriptingCVE-2025-12123 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Customer Reviews Collector for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'email-text' parameter in all versions up to, and including, 4.6.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Customer Reviews Collector for WooCommerce
- Affected
- up to 4.6.1
- What to do
- Affects up to 4.6.1. Update Customer Reviews Collector for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 27, 2025SKT PayPal for WooCommerce: Payment BypassCVE-2025-7820 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The SKT PayPal for WooCommerce plugin for WordPress is vulnerable to Payment Bypass in all versions up to, and including, 1.4. This is due to the plugin only enforcing client side controls instead of server-side controls when processing payments. This makes it possible for unauthenticated attackers to make confirmed purchases without actually paying for them.
- Product
- SKT PayPal for WooCommerce
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update SKT PayPal for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 25, 2025Admin and Customer Messages After Order for WooCommerce: OrderConvo: Missing AuthorizationCVE-2025-13452 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 14. This is due to a flawed permission check in the REST API permission callback that returns true when no nonce is provided. This makes it possible for unauthenticated attackers to impersonate any WordPress user and inject arbitrary messages into any WooCommerce order conversation by directly calling the REST endpoint with controlled user_id, order_id, and context parameters.
- Product
- Admin and Customer Messages After Order for WooCommerce: OrderConvo
- Affected
- up to 14
- What to do
- Affects up to 14. Update Admin and Customer Messages After Order for WooCommerce: OrderConvo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 25, 2025Admin and Customer Messages After Order for WooCommerce: OrderConvo: Unauthorized access of dataCVE-2025-13389 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the `get_order_by_id()` function in all versions up to, and including, 14. This makes it possible for unauthenticated attackers to view sensitive WooCommerce order details and private conversation messages between customers and store administrators for any order by supplying an arbitrary order ID.
- Product
- Admin and Customer Messages After Order for WooCommerce: OrderConvo
- Affected
- up to 14
- What to do
- Affects up to 14. Update Admin and Customer Messages After Order for WooCommerce: OrderConvo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.