Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

2,840 results · page 28 of 57

May 19, 2025Product Notes Tab & Private Admin Notes for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48239 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Product Notes Tab & Private Admin Notes for WooCommerce product-notes-for-woocommerce allows Stored XSS.This issue affects Product Notes Tab & Private Admin Notes for WooCommerce: from n/a through <= 3.1.0.
Product
Product Notes Tab & Private Admin Notes for WooCommerce
Affected
up to 3.1.0
What to do
Affects up to 3.1.0. Update Product Notes Tab & Private Admin Notes for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Wishlist for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48237 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Wishlist for WooCommerce wish-list-for-woocommerce allows Stored XSS.This issue affects Wishlist for WooCommerce: from n/a through <= 3.2.2.
Product
Wishlist for WooCommerce
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update Wishlist for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 17, 2025MultiVendorX – WooCommerce Multivendor Marketplace Solutions: Unauthorized loss of dataCVE-2025-4101 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The MultiVendorX – WooCommerce Multivendor Marketplace Solutions plugin for WordPress is vulnerable to unauthorized loss of data due to a misconfigured capability check on the 'delete_fpm_product' function in all versions up to, and including, 4.2.22. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary posts, pages, attachments, and products. The vulnerability was partially patched in version 4.2.22.
Product
MultiVendorX – WooCommerce Multivendor Marketplace Solutions
Affected
up to 4.2.22
What to do
Affects up to 4.2.22. Update MultiVendorX – WooCommerce Multivendor Marketplace Solutions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 16, 2025Wholesale Market WordPress plugin before 2.2.2, Wholesale Market for WooCommerce: Have a flawed CSRF checkCVE-2022-4363 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Wholesale Market WordPress plugin before 2.2.2, Wholesale Market for WooCommerce WordPress plugin before 2.0.1 have a flawed CSRF check when updating their settings, which could allow attackers to make a logged in admin update them via a CSRF attack
Product
Wholesale Market WordPress plugin before 2.2.2, Wholesale Market for WooCommerce
Fixed in
2.2.2
What to do
Update Wholesale Market WordPress plugin before 2.2.2, Wholesale Market for WooCommerce to 2.2.2 or newer.
Full record and what to do →NVD record wpscan.com
May 16, 2025Import Export For WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-48144 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in sidngr Import Export For WooCommerce import-export-for-woocommerce allows Stored XSS.This issue affects Import Export For WooCommerce: from n/a through <= 1.6.2.
Product
Import Export For WooCommerce
Affected
up to 1.6.2
What to do
Affects up to 1.6.2. Update Import Export For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025Sharespine Woocommerce Connector: Missing AuthorizationCVE-2025-48128 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Sharespine Sharespine Woocommerce Connector sharespine-woocommerce-connector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sharespine Woocommerce Connector: from n/a through <= 4.7.55.
Product
Sharespine Woocommerce Connector
Affected
up to 4.7.55
What to do
Affects up to 4.7.55. Update Sharespine Woocommerce Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025WooCommerce POS: Missing AuthorizationCVE-2025-48117 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in kilbot WooCommerce POS woocommerce-pos allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce POS: from n/a through <= 1.7.8.
Product
WooCommerce POS
Affected
up to 1.7.8
What to do
Affects up to 1.7.8. Update WooCommerce POS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025Better Customer List for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39537 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Blaze Concepts Better Customer List for WooCommerce woo-better-customer-list allows Reflected XSS.This issue affects Better Customer List for WooCommerce: from n/a through <= 1.2.3.
Product
Better Customer List for WooCommerce
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Better Customer List for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025Product Carousel For WooCommerce – WoorouSell: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32180 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojofywp Product Carousel For WooCommerce – WoorouSell woorousell allows Stored XSS.This issue affects Product Carousel For WooCommerce – WoorouSell: from n/a through <= 1.1.0.
Product
Product Carousel For WooCommerce – WoorouSell
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Product Carousel For WooCommerce – WoorouSell to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 15, 2025CTT Expresso para WooCommerce: Does not sanitise and escape some of its settingsCVE-2024-6478 · WordPress plugins & themes · reported by WPScanMedium 4.8
The CTT Expresso para WooCommerce WordPress plugin before 3.2.13 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
CTT Expresso para WooCommerce
Fixed in
3.2.13
What to do
Update CTT Expresso para WooCommerce to 3.2.13 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting: Is affected by an IDOR issue where employees can manipulate parameters to access the data of terminated employeesCVE-2024-12812 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 is affected by an IDOR issue where employees can manipulate parameters to access the data of terminated employees.
Product
WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting
Fixed in
1.13.4
What to do
Update WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting to 1.13.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting: Does not sanitise and escape some of its settingsCVE-2024-12808 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting
Fixed in
1.13.4
What to do
Update WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting to 1.13.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Real WP Shop Lite Ajax eCommerce Shopping Cart: Does not sanitise and escape some of its settingsCVE-2024-11140 · WordPress plugins & themes · reported by WPScanLow 3.5
The Real WP Shop Lite Ajax eCommerce Shopping Cart WordPress plugin through 2.0.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Real WP Shop Lite Ajax eCommerce Shopping Cart
Affected
up to 2.0.8
What to do
Affects up to 2.0.8. Update Real WP Shop Lite Ajax eCommerce Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025TicketBAI Facturas para WooCommerce: Arbitrary file deletionCVE-2025-4564 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The TicketBAI Facturas para WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation via the 'delpdf' action in all versions up to, and including, 3.18. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
TicketBAI Facturas para WooCommerce
Affected
up to 3.18
What to do
Affects up to 3.18. Update TicketBAI Facturas para WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 10, 2025SMS Alert Order Notifications – WooCommerce: Stored Cross-Site ScriptingCVE-2025-3878 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sa_verify shortcode in all versions up to, and including, 3.8.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
SMS Alert Order Notifications – WooCommerce
Affected
up to 3.8.1
What to do
Affects up to 3.8.1. Update SMS Alert Order Notifications – WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 10, 2025SMS Alert Order Notifications – WooCommerce: Privilege EscalationCVE-2025-3876 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to insufficient user OTP validation in the handleWpLoginCreateUserAction() function in all versions up to, and including, 3.8.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to impersonate any account by supplying its username or email and elevate their privileges to that of an administrator.
Product
SMS Alert Order Notifications – WooCommerce
Affected
up to 3.8.1
What to do
Affects up to 3.8.1. Update SMS Alert Order Notifications – WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 9, 2025Drag and Drop Multiple File Upload for WooCommerce: Arbitrary file uploadsCVE-2025-4403 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.1.6 due to accepting a user‐supplied supported_type string and the uploaded filename without enforcing real extension or MIME checks within the upload() function. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Drag and Drop Multiple File Upload for WooCommerce
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update Drag and Drop Multiple File Upload for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 8, 2025Wolmart | Multi-Vendor Marketplace WooCommerce: Arbitrary shortcode executionCVE-2024-13793 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The Wolmart | Multi-Vendor Marketplace WooCommerce Theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.8.11. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
Wolmart | Multi-Vendor Marketplace WooCommerce
Affected
up to 1.8.11
What to do
Affects up to 1.8.11. Update Wolmart | Multi-Vendor Marketplace WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
May 7, 2025Productive Commerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-47657 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Productive Minds Productive Commerce productive-commerce allows SQL Injection.This issue affects Productive Commerce: from n/a through <= 1.1.40.
Product
Productive Commerce
Affected
up to 1.1.40
What to do
Affects up to 1.1.40. Update Productive Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025Open Close WooCommerce Store: Path Traversal: '.../...//'CVE-2025-47649 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Path Traversal: '.../...//' vulnerability in StackWC Open Close WooCommerce Store woc-open-close allows PHP Local File Inclusion.This issue affects Open Close WooCommerce Store: from n/a through <= 4.9.9.
Product
Open Close WooCommerce Store
Affected
up to 4.9.9
What to do
Affects up to 4.9.9. Update Open Close WooCommerce Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025Pays – WooCommerce Payment Gateway: Cross-Site Request Forgery (CSRF)CVE-2025-47648 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in axima Pays – WooCommerce Payment Gateway axima-payment-gateway allows Stored XSS.This issue affects Pays – WooCommerce Payment Gateway: from n/a through <= 2.6.
Product
Pays – WooCommerce Payment Gateway
Affected
up to 2.6
What to do
Affects up to 2.6. Update Pays – WooCommerce Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025ELEX Product Feed for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-47643 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ELEXtensions ELEX Product Feed for WooCommerce allows SQL Injection. This issue affects ELEX Product Feed for WooCommerce: from n/a through 3.1.2.
Product
ELEX Product Feed for WooCommerce
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update ELEX Product Feed for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025Awin – Advertiser Tracking for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-47633 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Awin Awin – Advertiser Tracking for WooCommerce awin-advertiser-tracking allows Cross Site Request Forgery.This issue affects Awin – Advertiser Tracking for WooCommerce: from n/a through <= 2.0.0.
Product
Awin – Advertiser Tracking for WooCommerce
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Awin – Advertiser Tracking for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025Calculate Prices based on Distance For WooCommerce: Missing AuthorizationCVE-2025-47602 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in ammarahmad786 Calculate Prices based on Distance For WooCommerce calculate-prices-based-on-distance-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Calculate Prices based on Distance For WooCommerce: from n/a through <= 1.3.5.
Product
Calculate Prices based on Distance For WooCommerce
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update Calculate Prices based on Distance For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025Dynamic Pricing With Discount Rules for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-47544 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in acowebs Dynamic Pricing With Discount Rules for WooCommerce aco-woo-dynamic-pricing allows Blind SQL Injection.This issue affects Dynamic Pricing With Discount Rules for WooCommerce: from n/a through <= 4.5.8.
Product
Dynamic Pricing With Discount Rules for WooCommerce
Affected
up to 4.5.8
What to do
Affects up to 4.5.8. Update Dynamic Pricing With Discount Rules for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025Cart tracking for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-47538 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdever Cart tracking for WooCommerce cart-tracking-for-woocommerce allows SQL Injection.This issue affects Cart tracking for WooCommerce: from n/a through <= 1.0.17.
Product
Cart tracking for WooCommerce
Affected
up to 1.0.17
What to do
Affects up to 1.0.17. Update Cart tracking for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025PDF Invoice Builder for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-47537 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in add-ons.org PDF Invoice Builder for WooCommerce pdf-for-woocommerce allows SQL Injection.This issue affects PDF Invoice Builder for WooCommerce: from n/a through <= 5.3.8.
Product
PDF Invoice Builder for WooCommerce
Affected
up to 5.3.8
What to do
Affects up to 5.3.8. Update PDF Invoice Builder for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025GS Variation Swatches for WooCommerce: Missing AuthorizationCVE-2025-47526 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in GS Plugins GS Variation Swatches for WooCommerce gs-woo-variation-swatches allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GS Variation Swatches for WooCommerce: from n/a through <= 3.0.4.
Product
GS Variation Swatches for WooCommerce
Affected
up to 3.0.4
What to do
Affects up to 3.0.4. Update GS Variation Swatches for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025Product Time Countdown for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47505 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ProWCPlugins Product Time Countdown for WooCommerce product-countdown-for-woocommerce allows Stored XSS.This issue affects Product Time Countdown for WooCommerce: from n/a through <= 1.6.2.
Product
Product Time Countdown for WooCommerce
Affected
up to 1.6.2
What to do
Affects up to 1.6.2. Update Product Time Countdown for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025Custom Checkout Fields for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47504 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Custom Checkout Fields for WooCommerce custom-checkout-fields-for-woocommerce allows Stored XSS.This issue affects Custom Checkout Fields for WooCommerce: from n/a through <= 1.8.3.
Product
Custom Checkout Fields for WooCommerce
Affected
up to 1.8.3
What to do
Affects up to 1.8.3. Update Custom Checkout Fields for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025PW WooCommerce Bulk Edit: Cross-Site Request Forgery (CSRF)CVE-2025-47473 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in pimwick PW WooCommerce Bulk Edit pw-bulk-edit allows Cross Site Request Forgery.This issue affects PW WooCommerce Bulk Edit: from n/a through <= 2.134.
Product
PW WooCommerce Bulk Edit
Affected
up to 2.134
What to do
Affects up to 2.134. Update PW WooCommerce Bulk Edit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025Music Player for WooCommerce: Missing AuthorizationCVE-2025-47472 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in codepeople Music Player for WooCommerce music-player-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Music Player for WooCommerce: from n/a through <= 1.5.1.
Product
Music Player for WooCommerce
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update Music Player for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025TrackShip for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-47460 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TrackShip TrackShip for WooCommerce trackship-for-woocommerce allows SQL Injection.This issue affects TrackShip for WooCommerce: from n/a through <= 1.9.1.
Product
TrackShip for WooCommerce
Affected
up to 1.9.1
What to do
Affects up to 1.9.1. Update TrackShip for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025Integration for WooCommerce and Salesforce: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-47455 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for WooCommerce and Salesforce woo-salesforce-plugin-crm-perks allows Phishing.This issue affects Integration for WooCommerce and Salesforce: from n/a through <= 1.7.5.
Product
Integration for WooCommerce and Salesforce
Affected
up to 1.7.5
What to do
Affects up to 1.7.5. Update Integration for WooCommerce and Salesforce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025Product Quantity Dropdown For Woocommerce: Cross-Site Request Forgery (CSRF)CVE-2025-47451 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in silverplugins217 Product Quantity Dropdown For Woocommerce product-quantity-dropdown-for-woocommerce allows Cross Site Request Forgery.This issue affects Product Quantity Dropdown For Woocommerce: from n/a through <= 1.2.
Product
Product Quantity Dropdown For Woocommerce
Affected
up to 1.2
What to do
Affects up to 1.2. Update Product Quantity Dropdown For Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 6, 2025Woocommerce Multiple Addresses: Privilege EscalationCVE-2025-4335 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Woocommerce Multiple Addresses plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.7.1. This is due to insufficient restrictions on user meta that can be updated through the save_multiple_shipping_addresses() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator.
Product
Woocommerce Multiple Addresses
Affected
up to 1.0.7.1
What to do
Affects up to 1.0.7.1. Update Woocommerce Multiple Addresses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 6, 2025WPshop 2 – E-Commerce: Insecure Direct Object ReferenceCVE-2025-3853 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 2.0.0 to 2.6.0 via the callback_generate_api_key() due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create valid API keys on behalf of other users.
Product
WPshop 2 – E-Commerce
Affected
2.0.0 to 2.6.0
What to do
Affects 2.0.0 to 2.6.0. Update WPshop 2 – E-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 6, 2025WPshop 2 – E-Commerce: Privilege escalationCVE-2025-3852 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to privilege escalation via account takeover in versions 2.0.0 to 2.6.0. This is due to the plugin not properly validating a user's identity prior to updating their details like email & password through the update() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
Product
WPshop 2 – E-Commerce
Affected
2.0.0 to 2.6.0
What to do
Affects 2.0.0 to 2.6.0. Update WPshop 2 – E-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 2, 2025Advance Seat Reservation Management for WooCommerce: SQL InjectionCVE-2024-13344 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Advance Seat Reservation Management for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'profileId' parameter in all versions up to, and including, 3.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Advance Seat Reservation Management for WooCommerce
Affected
up to 3.3
What to do
Affects up to 3.3. Update Advance Seat Reservation Management for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
May 1, 2025The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin for WCVE-2025-2168 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.1. This is due to missing or incorrect nonce validation on the dismiss() function. This makes it possible for unauthenticated attackers to set arbitrary user meta values to `1` which can be leveraged to lock and administrator out of their site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 26, 2025Integração entre Eduzz e Woocommerce: Unauthorized modification of dataCVE-2025-3906 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Integração entre Eduzz e Woocommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wep_opcoes' function in all versions up to, and including, 1.7.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to edit the default registration role within the plugin's registration flow to Administrator, which allows any user to create an Administrator account.
Product
Integração entre Eduzz e Woocommerce
Affected
up to 1.7.5
What to do
Affects up to 1.7.5. Update Integração entre Eduzz e Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 25, 2025Upsell Funnel Builder for WooCommerce: Order manipulationCVE-2025-3743 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Upsell Funnel Builder for WooCommerce plugin for WordPress is vulnerable to order manipulation in all versions up to, and including, 3.0.0. This is due to the plugin allowing the additional product ID and discount field to be manipulated prior to processing via the 'add_offer_in_cart' function. This makes it possible for unauthenticated attackers to arbitrarily update the product associated with any order bump, and arbitrarily update the discount applied to any order bump item, when adding it to the cart.
Product
Upsell Funnel Builder for WooCommerce
Affected
up to 3.0.0
What to do
Affects up to 3.0.0. Update Upsell Funnel Builder for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 25, 2025ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor): Server-Side Request ForgeryCVE-2025-3775 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.2 via the woolentor_template_proxy function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application, and can be used to query and modify information from internal services.
Product
ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor)
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 24, 2025Bulk Assign Linked Products For WooCommerce: Missing AuthorizationCVE-2025-46489 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in vinodvaswani9 Bulk Assign Linked Products For WooCommerce wc-bulk-assign-linked-products allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Bulk Assign Linked Products For WooCommerce: from n/a through <= 2.1.
Product
Bulk Assign Linked Products For WooCommerce
Affected
up to 2.1
What to do
Affects up to 2.1. Update Bulk Assign Linked Products For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 24, 2025Checkout Field Visibility for WooCommerce: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39391 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in zamartz Checkout Field Visibility for WooCommerce checkout-field-visibility-for-woocommerce allows PHP Local File Inclusion.This issue affects Checkout Field Visibility for WooCommerce: from n/a through <= 1.3.0.
Product
Checkout Field Visibility for WooCommerce
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Checkout Field Visibility for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 24, 2025Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39378 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light excel-like-price-change-for-woocommerce-and-wp-e-commerce-light allows PHP Local File Inclusion.This issue affects Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: from n/a through <= 2.4.37.
Product
Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light
Affected
up to 2.4.37
What to do
Affects up to 2.4.37. Update Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 24, 2025ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes: SQL InjectionCVE-2025-3280 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin for WordPress is vulnerable to SQL Injection via the 'attribute_value_filter' parameter in all versions up to, and including, 1.4.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes
Affected
up to 1.4.9
What to do
Affects up to 1.4.9. Update ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Apr 24, 2025Woocommerce Automatic Order Printing | ( Formerly WooCommerce Google Cloud Print): Insecure Direct Object ReferenceCVE-2025-1284 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Woocommerce Automatic Order Printing | ( Formerly WooCommerce Google Cloud Print) plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1 via the xc_woo_printer_preview AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view other user's invoices and orders which can contain sensitive information.
Product
Woocommerce Automatic Order Printing | ( Formerly WooCommerce Google Cloud Print)
Affected
up to 4.1
What to do
Affects up to 4.1. Update Woocommerce Automatic Order Printing | ( Formerly WooCommerce Google Cloud Print) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Apr 22, 2025Advanced Linked Variations for Woocommerce: Missing AuthorizationCVE-2025-46244 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Dotstore Advanced Linked Variations for Woocommerce linked-variation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Linked Variations for Woocommerce: from n/a through <= 1.0.3.
Product
Advanced Linked Variations for Woocommerce
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Advanced Linked Variations for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 22, 2025Recover abandoned cart for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-46243 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in sonalsinha21 Recover abandoned cart for WooCommerce recover-wc-abandoned-cart allows Cross Site Request Forgery.This issue affects Recover abandoned cart for WooCommerce: from n/a through <= 2.2.
Product
Recover abandoned cart for WooCommerce
Affected
up to 2.2
What to do
Affects up to 2.2. Update Recover abandoned cart for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.