Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
38 results
Sep 30, 2026Administrator SQL Injection in Category Discount Woocommerce <= 5.18 versions.CVE-2026-96828 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in Category Discount Woocommerce <= 5.18 versions.
- Affected
- up to 5.18
- What to do
- Affects up to 5.18. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 4, 2026WPFunnels: Does not verify that the product requested through a checkout order bump is the product that bump's discount was configured forCVE-2026-79630 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a checkout order bump is the product that bump's discount was configured for, allowing unauthenticated users to obtain any purchasable product at a discount intended for a different one, with the reduced price carried through to the total of the order they place.
- Product
- WPFunnels
- Fixed in
- 3.13.0
- What to do
- Update WPFunnels to 3.13.0 or newer.
Aug 1, 2026Dynamic Pricing With Discount Rules for WooCommerce: Does not validate a nonce or user capabilities on one of its AJAX actions and reflects unsanitised user input in the responseCVE-2026-13725 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Dynamic Pricing With Discount Rules for WooCommerce WordPress plugin before 5.0.0 does not validate a nonce or user capabilities on one of its AJAX actions and reflects unsanitised user input in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against a victim who is induced to send a crafted request.
- Product
- Dynamic Pricing With Discount Rules for WooCommerce
- Fixed in
- 5.0.0
- What to do
- Update Dynamic Pricing With Discount Rules for WooCommerce to 5.0.0 or newer.
Jul 27, 2026Unauthenticated Cross Site Scripting (XSS) in Dynamic Pricing With Discount Rules for WooCommerce <= 4.5.11 versions.CVE-2026-59556 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Dynamic Pricing With Discount Rules for WooCommerce <= 4.5.11 versions.
- Affected
- up to 4.5.11
- What to do
- Affects up to 4.5.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 27, 2026Subscriber Sensitive Data Exposure in ShipTime: Discounted Shipping Rates <= 1.1.1 versions.CVE-2026-59528 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Subscriber Sensitive Data Exposure in ShipTime: Discounted Shipping Rates <= 1.1.1 versions.
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 26, 2026Unauthenticated Insecure Direct Object References (IDOR) in Payment Gateway Based Fees and Discounts for WooCommerce <= 3.0.0 versions.CVE-2026-56048 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Insecure Direct Object References (IDOR) in Payment Gateway Based Fees and Discounts for WooCommerce <= 3.0.0 versions.
- What to do
- Update the plugin to the newest version.
Apr 8, 2026ShipTime: Discounted Shipping Rates: Missing AuthorizationCVE-2026-39672 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in shiptime ShipTime: Discounted Shipping Rates shiptime-discount-shipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShipTime: Discounted Shipping Rates: from n/a through <= 1.1.1.
- Product
- ShipTime: Discounted Shipping Rates
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update ShipTime: Discounted Shipping Rates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Dynamic Pricing With Discount Rules for WooCommerce: Improper Control of Generation of Code ('Code Injection')CVE-2025-47588 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Improper Control of Generation of Code ('Code Injection') vulnerability in acowebs Dynamic Pricing With Discount Rules for WooCommerce aco-woo-dynamic-pricing allows Code Injection.This issue affects Dynamic Pricing With Discount Rules for WooCommerce: from n/a through <= 4.5.9.
- Product
- Dynamic Pricing With Discount Rules for WooCommerce
- Affected
- up to 4.5.9
- What to do
- Affects up to 4.5.9. Update Dynamic Pricing With Discount Rules for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Dynamic Pricing and Discount Rules: Cross-Site Request Forgery (CSRF)CVE-2025-49077 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ThemeHigh Dynamic Pricing and Discount Rules discount-and-dynamic-pricing allows Cross Site Request Forgery.This issue affects Dynamic Pricing and Discount Rules: from n/a through <= 2.2.9.
- Product
- Dynamic Pricing and Discount Rules
- Affected
- up to 2.2.9
- What to do
- Affects up to 2.2.9. Update Dynamic Pricing and Discount Rules to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Dynamic Pricing & Discounts Lite for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-48342 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in RedefiningTheWeb Dynamic Pricing & Discounts Lite for WooCommerce woo-dynamic-pricing-discounts-lite allows Cross Site Request Forgery.This issue affects Dynamic Pricing & Discounts Lite for WooCommerce: from n/a through <= 2.0.4.
- Product
- Dynamic Pricing & Discounts Lite for WooCommerce
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update Dynamic Pricing & Discounts Lite for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Sitewide Discount for WooCommerce: Apply Discount to All Products: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48248 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Sitewide Discount for WooCommerce: Apply Discount to All Products global-shop-discount-for-woocommerce allows Stored XSS.This issue affects Sitewide Discount for WooCommerce: Apply Discount to All Products: from n/a through <= 2.2.1.
- Product
- Sitewide Discount for WooCommerce: Apply Discount to All Products
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update Sitewide Discount for WooCommerce: Apply Discount to All Products to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Dynamic Pricing With Discount Rules for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-47544 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in acowebs Dynamic Pricing With Discount Rules for WooCommerce aco-woo-dynamic-pricing allows Blind SQL Injection.This issue affects Dynamic Pricing With Discount Rules for WooCommerce: from n/a through <= 4.5.8.
- Product
- Dynamic Pricing With Discount Rules for WooCommerce
- Affected
- up to 4.5.8
- What to do
- Affects up to 4.5.8. Update Dynamic Pricing With Discount Rules for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025Quantity Dynamic Pricing & Bulk Discounts for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31598 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Quantity Dynamic Pricing & Bulk Discounts for WooCommerce wholesale-pricing-woocommerce allows Stored XSS.This issue affects Quantity Dynamic Pricing & Bulk Discounts for WooCommerce: from n/a through <= 4.0.3.
- Product
- Quantity Dynamic Pricing & Bulk Discounts for WooCommerce
- Affected
- up to 4.0.3
- What to do
- Affects up to 4.0.3. Update Quantity Dynamic Pricing & Bulk Discounts for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 12, 2025Finale Lite – Sales Countdown Timer & Discount for WooCommerce: Stored DOM-Based Cross-Site ScriptingCVE-2024-12589 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Finale Lite – Sales Countdown Timer & Discount for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the countdown timer in all versions up to, and including, 2.19.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Finale Lite – Sales Countdown Timer & Discount for WooCommerce
- Affected
- up to 2.19.0
- What to do
- Affects up to 2.19.0. Update Finale Lite – Sales Countdown Timer & Discount for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 24, 2025Taxonomy/Term and Role based Discounts for WooCommerce: Missing AuthorizationCVE-2025-24625 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Marco Almeida | Webdados Taxonomy/Term and Role based Discounts for WooCommerce taxonomy-discounts-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Taxonomy/Term and Role based Discounts for WooCommerce: from n/a through <= 5.1.
- Product
- Taxonomy/Term and Role based Discounts for WooCommerce
- Affected
- up to 5.1
- What to do
- Affects up to 5.1. Update Taxonomy/Term and Role based Discounts for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 10, 2025Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups: PHP Object InjectionCVE-2024-12627 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.5 via deserialization of untrusted input from post content passed to the capture_email AJAX action. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
- Product
- Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 10, 2025Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups: Unauthorized accessCVE-2024-12204 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several functions in the class-cx-rest.php file in all versions up to, and including, 1.3.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create 100% off coupons, delete posts, delete leads, and update coupon statuses.
- Product
- Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 24, 2024ELEX WooCommerce Dynamic Pricing and Discounts: Unauthorized access of dataCVE-2024-12266 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The ELEX WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the elex_dp_export_rules() and elex_dp_import_rules() functions in all versions up to, and including, 2.1.7. This makes it possible for unauthenticated attackers to import and export product rules along with obtaining phpinfo() data
- Product
- ELEX WooCommerce Dynamic Pricing and Discounts
- Affected
- up to 2.1.7
- What to do
- Affects up to 2.1.7. Update ELEX WooCommerce Dynamic Pricing and Discounts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 12, 2024Seraphinite Bulk Discounts for WooCommerce: Reflected Cross-Site ScriptingCVE-2024-12160 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Seraphinite Bulk Discounts for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.4.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Seraphinite Bulk Discounts for WooCommerce
- Affected
- up to 2.4.6
- What to do
- Affects up to 2.4.6. Update Seraphinite Bulk Discounts for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 9, 2024AmaDiscount: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51608 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in colinph970 AmaDiscount amadiscount allows SQL Injection.This issue affects AmaDiscount: from n/a through <= 1.0.
- Product
- AmaDiscount
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update AmaDiscount to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 16, 2024Discount Rules for WooCommerce: Missing authorizationCVE-2020-36834 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The Discount Rules for WooCommerce plugin for WordPress is vulnerable to missing authorization via several AJAX actions in versions up to, and including, 2.0.2 due to missing capability checks on various functions. This makes it possible for subscriber-level attackers to execute various actions and perform a wide variety of actions such as modifying rules and saving configurations.
- Product
- Discount Rules for WooCommerce
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update Discount Rules for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordfence.com
Oct 15, 2024Discount Rules for WooCommerce – Create Smart WooCommerce Coupons & Discounts, Bulk Discount, BOGO Coupons: Reflected Cross-Site ScriptingCVE-2024-8541 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The Discount Rules for WooCommerce – Create Smart WooCommerce Coupons & Discounts, Bulk Discount, BOGO Coupons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.6.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a site administrator into performing an action such as clicking on a link. Please note that this is only exploitable when the 'Leave a Review' notice is present, which occurs after 100 orders are made and disappears after a user dismisses the notice.
- Product
- Discount Rules for WooCommerce – Create Smart WooCommerce Coupons & Discounts, Bulk Discount, BOGO Coupons
- Affected
- up to 2.6.5
- What to do
- Affects up to 2.6.5. Update Discount Rules for WooCommerce – Create Smart WooCommerce Coupons & Discounts, Bulk Discount, BOGO Coupons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 4, 2024Quantity Dynamic Pricing & Bulk Discounts for WooCommerce: Reflected Cross-Site ScriptingCVE-2024-9384 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Quantity Dynamic Pricing & Bulk Discounts for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.8.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Quantity Dynamic Pricing & Bulk Discounts for WooCommerce
- Affected
- up to 3.8.0
- What to do
- Affects up to 3.8.0. Update Quantity Dynamic Pricing & Bulk Discounts for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 26, 2024ParityPress – Parity Pricing with Discount Rules: Stored Cross-Site ScriptingCVE-2024-6661 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The ParityPress – Parity Pricing with Discount Rules plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Discount Text' in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- ParityPress – Parity Pricing with Discount Rules
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update ParityPress – Parity Pricing with Discount Rules to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 29, 2024Payment Gateway Based Fees and Discounts for WooCommerce: Missing AuthorizationCVE-2024-33585 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Tyche Softwares Payment Gateway Based Fees and Discounts for WooCommerce.This issue affects Payment Gateway Based Fees and Discounts for WooCommerce: from n/a through 2.12.1.
- Product
- Payment Gateway Based Fees and Discounts for WooCommerce
- Affected
- up to 2.12.1
- What to do
- Affects up to 2.12.1. Update Payment Gateway Based Fees and Discounts for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 24, 2024Coupon & Discount Code Reveal Button: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32722 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Coupon & Discount Code Reveal Button allows Stored XSS.This issue affects Coupon & Discount Code Reveal Button: from n/a through 1.2.5.
- Product
- Coupon & Discount Code Reveal Button
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update Coupon & Discount Code Reveal Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 12, 2024ELEX WooCommerce Dynamic Pricing and Discounts: Cross-Site Request Forgery (CSRF)CVE-2024-31364 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ELEXtensions ELEX WooCommerce Dynamic Pricing and Discounts.This issue affects ELEX WooCommerce Dynamic Pricing and Discounts: from n/a through 2.1.2.
- Product
- ELEX WooCommerce Dynamic Pricing and Discounts
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update ELEX WooCommerce Dynamic Pricing and Discounts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 11, 2024ELEX WooCommerce Dynamic Pricing and Discounts: Cross-Site Request Forgery (CSRF)CVE-2024-32105 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ELEXtensions ELEX WooCommerce Dynamic Pricing and Discounts.This issue affects ELEX WooCommerce Dynamic Pricing and Discounts: from n/a through 2.1.2.
- Product
- ELEX WooCommerce Dynamic Pricing and Discounts
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update ELEX WooCommerce Dynamic Pricing and Discounts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 7, 2024ELEX WooCommerce Dynamic Pricing and Discounts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31255 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ELEXtensions ELEX WooCommerce Dynamic Pricing and Discounts allows Reflected XSS.This issue affects ELEX WooCommerce Dynamic Pricing and Discounts: from n/a through 2.1.2.
- Product
- ELEX WooCommerce Dynamic Pricing and Discounts
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update ELEX WooCommerce Dynamic Pricing and Discounts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 1, 2024The NextMove Lite – Thank You Page for WooCommerce and Finale Lite – Sales Countdown Timer & Discount for WooCommerce plugins for WordPress are vulnerable to unCVE-2024-1120 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The NextMove Lite – Thank You Page for WooCommerce and Finale Lite – Sales Countdown Timer & Discount for WooCommerce plugins for WordPress are vulnerable to unauthorized access of data due to a missing capability check on the download_tools_settings() function in all versions up to, and including, 2.17.0. This makes it possible for unauthenticated attackers to export system information that can aid attackers in an attack.
- Affected
- up to 2.17.0
- What to do
- Affects up to 2.17.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 26, 2024WooCommerce Easy Checkout Field Editor, Fees & Discounts: Unrestricted Upload of File with Dangerous TypeCVE-2024-25925 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in SYSBASICS WooCommerce Easy Checkout Field Editor, Fees & Discounts.This issue affects WooCommerce Easy Checkout Field Editor, Fees & Discounts: from n/a through 3.5.12.
- Product
- WooCommerce Easy Checkout Field Editor, Fees & Discounts
- Affected
- up to 3.5.12
- What to do
- Affects up to 3.5.12. Update WooCommerce Easy Checkout Field Editor, Fees & Discounts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 24, 2024Category Discount Woocommerce: Unauthorized modification of dataCVE-2024-0617 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Category Discount Woocommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpcd_save_discount() function in all versions up to, and including, 4.12. This makes it possible for unauthenticated attackers to modify product category discounts that could lead to loss of revenue.
- Product
- Category Discount Woocommerce
- Affected
- up to 4.12
- What to do
- Affects up to 4.12. Update Category Discount Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 18, 2023First Order Discount Woocommerce: Cross-Site Request Forgery (CSRF)CVE-2023-49843 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in QuanticEdge First Order Discount Woocommerce.This issue affects First Order Discount Woocommerce: from n/a through 1.21.
- Product
- First Order Discount Woocommerce
- Affected
- up to 1.21
- What to do
- Affects up to 1.21. Update First Order Discount Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 20, 2023WooCommerce Dynamic Pricing and Discounts: Unauthenticated settings exportCVE-2021-4353 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to unauthenticated settings export in versions up to, and including, 2.4.1. This is due to missing authorization on the export() function which makes makes it possible for unauthenticated attackers to export the plugin's settings.
- Product
- WooCommerce Dynamic Pricing and Discounts
- Affected
- up to 2.4.1
- What to do
- Affects up to 2.4.1. Update WooCommerce Dynamic Pricing and Discounts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwordfence.com
Oct 4, 2023Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Dynamic Pricing and Discount Rules for WooCommerce plugin <= 2.4.0 versions.CVE-2023-40559 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Dynamic Pricing and Discount Rules for WooCommerce plugin <= 2.4.0 versions.
- Fixed in
- 2.4.1
- What to do
- Update the plugin to 2.4.1 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 6, 2023WooCommerce Dynamic Pricing and Discounts: Stored Cross-Site ScriptingCVE-2021-4372 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.1. This is due to missing sanitization on the settings imported via the import() function. This makes it possible for unauthenticated attackers to import a settings file containing malicious JavaScript that would execute when an administrator accesses the settings area of the site.
- Product
- WooCommerce Dynamic Pricing and Discounts
- Affected
- up to 2.4.1
- What to do
- Affects up to 2.4.1. Update WooCommerce Dynamic Pricing and Discounts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwordfence.com
Jul 17, 2022Discount Rules for WooCommerce: Does not escape a parameter before outputting it back in an attribute of the plugin's discount rule pageCVE-2022-2090 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Discount Rules for WooCommerce WordPress plugin before 2.4.2 does not escape a parameter before outputting it back in an attribute of the plugin's discount rule page, leading to Reflected Cross-Site Scripting
- Product
- Discount Rules for WooCommerce
- Fixed in
- 2.4.2
- What to do
- Update Discount Rules for WooCommerce to 2.4.2 or newer.
Feb 7, 2022Paid Memberships Pro: Does not escape the discount_code in one of its REST route (available to unauthenticated users) before using it in a SQL statementCVE-2021-25114 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Paid Memberships Pro WordPress plugin before 2.6.7 does not escape the discount_code in one of its REST route (available to unauthenticated users) before using it in a SQL statement, leading to a SQL injection
- Product
- Paid Memberships Pro
- Fixed in
- 2.6.7
- What to do
- Update Paid Memberships Pro to 2.6.7 or newer.
Full record and what to do →NVD recordwpscan.compaidmembershipspro.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.