Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

588new WordPress flaws this week

391,288entries in the database

2,840 results · page 12 of 57

Jul 23, 2026Lumise Product Designer for WooCommerce: SQL InjectionCVE-2026-9713 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' and 'table' parameters in the uploaded cart JSON file processed by the checkout AJAX action in versions up to, and including, 2.1.1. This is due to insufficient escaping on the user-supplied parameters before they are appended directly to a raw SQL query in the find_resource() function — the 'id' field is interpolated without quotes into a WHERE clause (numeric context) and 'table' is interpolated into the FROM clause, neither of which is protected by wp_magic_quotes or passed through $wpdb->prepare(). This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Lumise Product Designer for WooCommerce
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update Lumise Product Designer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jul 21, 2026bpost-shipping-platform: Does not properly sanitize a parameter before using it in a SQL query during WooCommerce order submissionCVE-2026-8082 · WordPress plugins & themes · reported by WPScanHigh 7.5
The bpost-shipping-platform WordPress plugin before 3.2.3 does not properly sanitize a parameter before using it in a SQL query during WooCommerce order submission, allowing unauthenticated attackers to perform time-based blind SQL injection on stores running this bpost-shipping-platform WordPress plugin before 3.2.3.
Product
bpost-shipping-platform
Fixed in
3.2.3
What to do
Update bpost-shipping-platform to 3.2.3 or newer.
Full record and what to do →NVD record wpscan.com
Jul 18, 2026The Flow Payment plugin for WordPress (flow.cl) version 3.0.8 is vulnerable to reflected cross-site scripting on the WooCommerce checkout page.CVE-2026-57857 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
The Flow Payment plugin for WordPress (flow.cl) version 3.0.8 is vulnerable to reflected cross-site scripting on the WooCommerce checkout page. When the plugin handles an order cancellation, the error_message GET parameter is passed directly to wc_add_notice() in flowpayment-fl.php (lines 57-58) without input sanitization (for example sanitize_text_field()) or output escaping (for example esc_html()) before being rendered in the checkout notice HTML. An unauthenticated attacker can craft a URL containing a JavaScript payload in the error_message parameter (for example /checkout/?add-to-cart={product-id}&cancel_order=true&error_message={payload}); when a victim with an active WooCommerce checkout session follows the link, the payload executes in the victim's browser in the origin of the WordPress site.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record flow.cl vulncheck.com
Jul 17, 2026WPS Bookings for WooCommerce: Does not verify that a booking order belongs to the requesting user before cancelling itCVE-2026-12393 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPS Bookings for WooCommerce WordPress plugin before 3.11.7 does not verify that a booking order belongs to the requesting user before cancelling it, allowing any authenticated user, such as a Subscriber or Customer, to cancel and void other customers' booking orders.
Product
WPS Bookings for WooCommerce
Fixed in
3.11.7
What to do
Update WPS Bookings for WooCommerce to 3.11.7 or newer.
Full record and what to do →NVD record wpscan.com
Jul 17, 2026ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form: Stored Cross-Site ScriptingCVE-2026-15759 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'number' and 'group' Shortcode Attributes in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form
Affected
up to 3.5.1
What to do
Affects up to 3.5.1. Update ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 17, 2026ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce: Authorization bypassCVE-2026-15349 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.17.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary company locations in the ERP database.
Product
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
Affected
up to 1.17.6
What to do
Affects up to 1.17.6. Update ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 17, 2026Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Arbitrary File UploadCVE-2026-13352 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 4.16.18 via the allowed_mime_types function. This is due to the unconditional registration of an upload_mimes filter that adds executable file extensions (.exe, .apk, .msi) to the global WordPress MIME allowlist, without scoping the expansion to digital-product upload contexts. This makes it possible for authenticated attackers, with author-level access and above, to upload files that may be executable, which makes remote code execution possible. This filter is registered globally on every request regardless of whether the digital products feature is configured or in use, meaning the expanded MIME allowlist affects all WordPress upload contexts site-wide.
Product
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
Affected
up to 4.16.18
What to do
Affects up to 4.16.18. Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 17, 2026The WooCommerce Placetopay Gateway and PlacetoPay/AvalPay gateway plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the 'redirect-url' CVE-2026-11324 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WooCommerce Placetopay Gateway and PlacetoPay/AvalPay gateway plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the 'redirect-url' parameter in versions up to, and including, 3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record banco.santander.cl evertecinc.com
Jul 16, 2026SysBasics Customize My Account for WooCommerce – Live My Account Customizer: Stored Cross-Site ScriptingCVE-2026-15324 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The SysBasics Customize My Account for WooCommerce – Live My Account Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'row_type' parameter in all versions up to, and including, 4.4.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with shop manager-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
SysBasics Customize My Account for WooCommerce – Live My Account Customizer
Affected
up to 4.4.14
What to do
Affects up to 4.4.14. Update SysBasics Customize My Account for WooCommerce – Live My Account Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 16, 2026WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell: Privilege EscalationCVE-2026-15103 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Privilege Escalation via arbitrary option update in all versions up to, and including, 3.12.8. This is due to the `update_settings()` REST callback failing to validate the `group_id` path parameter against an allowlist of permitted option names before passing it directly to `get_option()` and `update_option()`, allowing the built-in `wp_user_roles` option — which satisfies the route's loose `[\w-]+` regex — to be targeted. This makes it possible for authenticated attackers with the `wpf_manage_funnels` capability and above to elevate their privileges to administrator by writing a crafted role definition containing arbitrary capabilities into the `wp_user_roles` option, thereby granting any WordPress role full site administrator access. The `wpf_manage_funnels` capability is typically assigned to the Funnel Manager custom role created by the plugin, meaning this role is the minimum required to exploit the vulnerability.
Product
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
Affected
up to 3.12.8
What to do
Affects up to 3.12.8. Update WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 16, 2026Customer Reviews for WooCommerce: Does not perform authenticationCVE-2026-12684 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Customer Reviews for WooCommerce WordPress plugin before 5.113.0 does not perform authentication, capability, or nonce checks on one of its media upload AJAX actions when the review media attachment feature is enabled, allowing unauthenticated users to upload media files (bounded to an image and video allowlist) to the Media Library and create attachment posts, leading to media library pollution and disk space exhaustion.
Product
Customer Reviews for WooCommerce
Fixed in
5.113.0
What to do
Update Customer Reviews for WooCommerce to 5.113.0 or newer.
Full record and what to do →NVD record wpscan.com
Jul 16, 2026Abandoned Cart Lite for WooCommerce: Does not protect the integrity of its cart-recovery tokens or bind them to the requesting accountCVE-2026-12585 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Abandoned Cart Lite for WooCommerce WordPress plugin before 6.8.2 does not protect the integrity of its cart-recovery tokens or bind them to the requesting account, allowing unauthenticated attackers to forge a recovery link that logs them in as another user when the automatic-login option is enabled.
Product
Abandoned Cart Lite for WooCommerce
Fixed in
6.8.2
What to do
Update Abandoned Cart Lite for WooCommerce to 6.8.2 or newer.
Full record and what to do →NVD record wpscan.com
Jul 16, 2026Happy Coders OTP Login for WooCommerce: Does not verify that a one-time password was actually validated before authenticating a user based on a supplied identifierCVE-2026-12492 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Happy Coders OTP Login for WooCommerce WordPress plugin before 2.8 does not verify that a one-time password was actually validated before authenticating a user based on a supplied identifier, allowing unauthenticated attackers to log in as any existing user, including administrators, as well as to create new accounts.
Product
Happy Coders OTP Login for WooCommerce
Fixed in
2.8
What to do
Update Happy Coders OTP Login for WooCommerce to 2.8 or newer.
Full record and what to do →NVD record wpscan.com
Jul 16, 2026Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces: Reflected Cross-Site ScriptingCVE-2026-15306 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 's' Search Parameter in all versions up to, and including, 7.6.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces
Affected
up to 7.6.1
What to do
Affects up to 7.6.1. Update Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 16, 2026MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions: Generic SQL InjectionCVE-2026-12941 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions plugin for WordPress is vulnerable to generic SQL Injection via the 'order_by' parameter in all versions up to, and including, 5.0.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This vulnerability is exploitable by any authenticated subscriber-level user when the plugin's store approval setting is configured to automatically approve store owners (described as the default), as this allows any logged-in user to self-register as a store_owner via the public Stores REST endpoint, thereby obtaining the edit_stores capability required to reach the vulnerable transactions endpoint.
Product
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions
Affected
up to 5.0.9
What to do
Affects up to 5.0.9. Update MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 16, 2026Advance Product Search- Voice & Ajax Search for WooCommerce: Generic SQL InjectionCVE-2026-12753 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Advance Product Search- Voice & Ajax Search for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 's' and 'match' parameter in all versions up to, and including, 1.4.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Advance Product Search- Voice & Ajax Search for WooCommerce
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update Advance Product Search- Voice & Ajax Search for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 13, 2026License Manager for WooCommerce: Missing AuthorizationCVE-2026-61958 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Saad Iqbal License Manager for WooCommerce license-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects License Manager for WooCommerce: from n/a through <= 3.0.17.
Product
License Manager for WooCommerce
Affected
up to 3.0.17
What to do
Affects up to 3.0.17. Update License Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026WooCommerce Bulk Edit Products – WP Sheet Editor: Missing AuthorizationCVE-2026-61952 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Missing Authorization vulnerability in Jose Vega WooCommerce Bulk Edit Products – WP Sheet Editor woo-bulk-edit-products allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Bulk Edit Products – WP Sheet Editor: from n/a through <= 1.8.21.
Product
WooCommerce Bulk Edit Products – WP Sheet Editor
Affected
up to 1.8.21
What to do
Affects up to 1.8.21. Update WooCommerce Bulk Edit Products – WP Sheet Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026APIExperts Square for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-57810 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal APIExperts Square for WooCommerce woosquare allows Blind SQL Injection.This issue affects APIExperts Square for WooCommerce: from n/a through <= 4.7.4.
Product
APIExperts Square for WooCommerce
Affected
up to 4.7.4
What to do
Affects up to 4.7.4. Update APIExperts Square for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026Advanced Shipment Tracking for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-57773 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zorem Advanced Shipment Tracking for WooCommerce woo-advanced-shipment-tracking allows Blind SQL Injection.This issue affects Advanced Shipment Tracking for WooCommerce: from n/a through <= 4.0.
Product
Advanced Shipment Tracking for WooCommerce
Affected
up to 4.0
What to do
Affects up to 4.0. Update Advanced Shipment Tracking for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026Membership For WooCommerce: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-57709 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP Swings Membership For WooCommerce membership-for-woocommerce allows Path Traversal.This issue affects Membership For WooCommerce: from n/a through <= 3.1.0.
Product
Membership For WooCommerce
Affected
up to 3.1.0
What to do
Affects up to 3.1.0. Update Membership For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026Abandoned Cart Recovery for WooCommerce: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-57698 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authentication Bypass Using an Alternate Path or Channel vulnerability in VillaTheme Abandoned Cart Recovery for WooCommerce woo-abandoned-cart-recovery allows Authentication Abuse.This issue affects Abandoned Cart Recovery for WooCommerce: from n/a through <= 1.1.12.
Product
Abandoned Cart Recovery for WooCommerce
Affected
up to 1.1.12
What to do
Affects up to 1.1.12. Update Abandoned Cart Recovery for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026Razorpay Payment Links for WooCommerce: Missing AuthorizationCVE-2026-57424 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in knitpay Razorpay Payment Links for WooCommerce rzp-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Razorpay Payment Links for WooCommerce: from n/a through <= 2.1.4.
Product
Razorpay Payment Links for WooCommerce
Affected
up to 2.1.4
What to do
Affects up to 2.1.4. Update Razorpay Payment Links for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026Bopo – WooCommerce Product Bundle Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57422 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Bopo – WooCommerce Product Bundle Builder bopo-woo-product-bundle-builder allows Reflected XSS.This issue affects Bopo – WooCommerce Product Bundle Builder: from n/a through <= 1.2.0.
Product
Bopo – WooCommerce Product Bundle Builder
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Bopo – WooCommerce Product Bundle Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026Stock Locations for WooCommerce: Missing AuthorizationCVE-2026-57419 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Fahad Mahmood Stock Locations for WooCommerce stock-locations-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stock Locations for WooCommerce: from n/a through <= 3.1.8.
Product
Stock Locations for WooCommerce
Affected
up to 3.1.8
What to do
Affects up to 3.1.8. Update Stock Locations for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026ChatBot for eCommerce – WoowBot: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57414 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud ChatBot for eCommerce – WoowBot woowbot-woocommerce-chatbot allows Stored XSS.This issue affects ChatBot for eCommerce – WoowBot: from n/a through <= 4.6.1.
Product
ChatBot for eCommerce – WoowBot
Affected
up to 4.6.1
What to do
Affects up to 4.6.1. Update ChatBot for eCommerce – WoowBot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026Active Products Tables for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57409 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows DOM-Based XSS.This issue affects Active Products Tables for WooCommerce: from n/a through <= 1.1.0.
Product
Active Products Tables for WooCommerce
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Active Products Tables for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026Flexible Refund and Return Order for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57402 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdesk Flexible Refund and Return Order for WooCommerce flexible-refund-and-return-order-for-woocommerce allows Stored XSS.This issue affects Flexible Refund and Return Order for WooCommerce: from n/a through <= 1.0.51.
Product
Flexible Refund and Return Order for WooCommerce
Affected
up to 1.0.51
What to do
Affects up to 1.0.51. Update Flexible Refund and Return Order for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026Event Tickets Manager for WooCommerce: Missing AuthorizationCVE-2026-57400 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WP Swings Event Tickets Manager for WooCommerce event-tickets-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets Manager for WooCommerce: from n/a through <= 1.5.5.
Product
Event Tickets Manager for WooCommerce
Affected
up to 1.5.5
What to do
Affects up to 1.5.5. Update Event Tickets Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026Free Gifts for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57396 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Flintop Free Gifts for WooCommerce free-gifts-for-woocommerce allows Stored XSS.This issue affects Free Gifts for WooCommerce: from n/a through <= 13.1.0.
Product
Free Gifts for WooCommerce
Affected
up to 13.1.0
What to do
Affects up to 13.1.0. Update Free Gifts for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026WooCommerce PDF Invoice Builder: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-57393 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in EDGARROJAS WooCommerce PDF Invoice Builder woo-pdf-invoice-builder allows Retrieve Embedded Sensitive Data.This issue affects WooCommerce PDF Invoice Builder: from n/a through <= 2.0.8.
Product
WooCommerce PDF Invoice Builder
Affected
up to 2.0.8
What to do
Affects up to 2.0.8. Update WooCommerce PDF Invoice Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026Extra Product Options Builder for WooCommerce: Missing AuthorizationCVE-2026-57390 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in EDGARROJAS Extra Product Options Builder for WooCommerce additional-product-fields-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Extra Product Options Builder for WooCommerce: from n/a through <= 1.2.167.
Product
Extra Product Options Builder for WooCommerce
Affected
up to 1.2.167
What to do
Affects up to 1.2.167. Update Extra Product Options Builder for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 11, 2026CorvusPay WooCommerce Payment Gateway: Stored Cross-Site ScriptingCVE-2026-6939 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'approval_code' parameter in all versions up to, and including, 2.7.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The unauthenticated REST endpoint POST /wp-json/corvuspay/success/ is registered with permission_callback set to __return_true, and although a signature validation step exists it only logs the result without halting execution, meaning an attacker can supply a completely arbitrary signature and have a malicious approval_code stored in the database unchallenged.
Product
CorvusPay WooCommerce Payment Gateway
Affected
up to 2.7.4
What to do
Affects up to 2.7.4. Update CorvusPay WooCommerce Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 11, 2026WCFM – Frontend Manager for WooCommerce: Authorization bypassCVE-2026-12994 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WCFM – Frontend Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.7.27. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to inject arbitrary reply content into any store inquiry, overwrite the main inquiry record in wp_wcfm_enquiries, and trigger unsolicited notification emails to customers and vendors. Unlike sibling controller branches (wcfm-enquiry and wcfm-enquiry-manage), the wcfm-my-account-enquiry-manage branch performs no is_user_logged_in() or current_user_can() check, and the nonce that serves as the sole barrier is embedded into every public page load without any login gate.
Product
WCFM – Frontend Manager for WooCommerce
Affected
up to 6.7.27
What to do
Affects up to 6.7.27. Update WCFM – Frontend Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 11, 2026WCFM Marketplace – Multivendor Marketplace for WooCommerce: Stored Cross-Site ScriptingCVE-2026-12126 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment 'post_title' in all versions up to, and including, 3.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Vendor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. An attacker can plant the payload by uploading a media attachment with a crafted title via the WordPress REST API (/wp-json/wp/v2/media), without ever invoking the AJAX endpoint themselves, as the unescaped title is later emitted inside DataTables JSON and inserted as innerHTML upon any privileged user loading the media dashboard.
Product
WCFM Marketplace – Multivendor Marketplace for WooCommerce
Affected
up to 3.7.3
What to do
Affects up to 3.7.3. Update WCFM Marketplace – Multivendor Marketplace for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 11, 2026Wallet for WooCommerce: Authorization bypassCVE-2026-12103 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Wallet for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.6.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to enumerate the login name, email address, and user ID of all WordPress accounts — including administrators — by submitting arbitrary search terms to the AJAX handler. The required 'search-user' nonce is localized into the wallet_param object on the standard WooCommerce My Account page, which is accessible to any authenticated user, making it trivially obtainable by a Subscriber.
Product
Wallet for WooCommerce
Affected
up to 1.6.4
What to do
Affects up to 1.6.4. Update Wallet for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 11, 2026WCFM – Frontend Manager for WooCommerce: Insecure Direct Object ReferenceCVE-2026-10041 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WCFM – Frontend Manager for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.27 via the wcfm_product_archive due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to archive arbitrary vendors' products, toggle the featured status on arbitrary listings, mark arbitrary WooCommerce orders as completed, and permanently delete arbitrary enquiries and bulk messages belonging to other vendors.
Product
WCFM – Frontend Manager for WooCommerce
Affected
up to 6.7.27
What to do
Affects up to 6.7.27. Update WCFM – Frontend Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 11, 2026PDF Invoices & Packing Slips for WooCommerce: Insecure Direct Object ReferenceCVE-2026-13116 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.14.0 via the generate_document_shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to mint publicly accessible, session-free download links for arbitrary third-party orders, exposing customer names, billing and shipping addresses, email addresses, phone numbers, order and invoice numbers, line items, totals, payment details, and customer notes contained in those orders' invoices and packing slips. Exploitation requires the plugin's Document link access type setting to be configured to 'full'; with the default 'logged_in' value, generated URLs are signed with a per-session nonce rather than the order_key, making the shortcode path unexploitable for unauthorized access to third-party orders.
Product
PDF Invoices & Packing Slips for WooCommerce
Affected
up to 5.14.0
What to do
Affects up to 5.14.0. Update PDF Invoices & Packing Slips for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 11, 2026Points and Rewards for WooCommerce: Authorization bypassCVE-2026-10628 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Points and Rewards for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.10.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to convert and drain any user's reward points into wallet balance, exfiltrate all users' emails and point balances to an attacker-controlled Klaviyo account, overwrite the site's Klaviyo public API key, block or unblock arbitrary users from the points system, and modify campaign banner and heading settings. The nonce used for authentication of these requests (wps-wpr-verify-nonce) is injected into every public-facing page via wp_localize_script(), and the wps_wpr_generate_custom_wallet handler is additionally registered on the wp_ajax_nopriv_ hook, meaning unauthenticated visitors can also obtain a valid nonce and exploit that specific action.
Product
Points and Rewards for WooCommerce
Affected
up to 2.10.0
What to do
Affects up to 2.10.0. Update Points and Rewards for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 10, 2026UnderConstructionPage PRO: Arbitrary File ReadCVE-2026-11426 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The UnderConstructionPage PRO plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.76. This is due to the plugin accepting arbitrary local file paths in the template_thumbnail parameter and copying their contents into a publicly accessible uploads file. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read arbitrary files on the server, which can contain sensitive information.
Product
UnderConstructionPage PRO
Affected
up to 5.76
What to do
Affects up to 5.76. Update UnderConstructionPage PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record underconstructionpage.com wordfence.com
Jul 10, 2026Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails: Generic SQL InjectionCVE-2026-12918 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to generic SQL Injection via the 'recipients' parameter in all versions up to, and including, 1.24.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order SQL injection: the malicious payload is first stored unsanitized via a POST request to /mrm/v1/campaigns/ (bypassing filter_recipients() validation because an int-cast of a string like '1) OR ...' evaluates to a real numeric ID), and is then triggered by a subsequent GET request to /mrm/v1/campaigns/{id} that deserializes the recipients and passes the raw id string through array_column() into the vulnerable query.
Product
Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails
Affected
up to 1.24.1
What to do
Affects up to 1.24.1. Update Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2026Colissimo Officiel : Méthodes de livraison pour WooCommerce: Unauthorized modification of dataCVE-2026-9240 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the updateShippingMethod() function (registered to the wp_ajax_lpc_order_affect AJAX action) in versions up to, and including, 2.9.0. This is due to the handler performing no current_user_can() capability check and no nonce verification before reading an attacker-supplied order_id and modifying that order's shipping method, pickup-point meta, and shipping address. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create or modify the shipment information (shipping method, pickup relay data, and shipping address) of arbitrary WooCommerce orders, including orders placed by other users.
Product
Colissimo Officiel : Méthodes de livraison pour WooCommerce
Affected
up to 2.9.0
What to do
Affects up to 2.9.0. Update Colissimo Officiel : Méthodes de livraison pour WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2026DHL eCommerce (Benelux) for WooCommerce: Unauthorized modification and loss of dataCVE-2026-9235 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The DHL eCommerce (Benelux) for WooCommerce plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check and missing nonce verification on the create_label() and delete_label() functions in versions up to, and including, 2.2.3. These functions are wired to the wp_ajax_dhlpwc_label_create and wp_ajax_dhlpwc_label_delete hooks and act on an attacker-supplied post_id (WooCommerce order ID). This makes it possible for authenticated attackers, with Subscriber-level access and above, to create or delete DHL shipping labels associated with any WooCommerce order on the site.
Product
DHL eCommerce (Benelux) for WooCommerce
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update DHL eCommerce (Benelux) for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2026CorvusPay WooCommerce Payment Gateway: Authorization bypassCVE-2026-9028 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.7.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to cancel any WooCommerce order placed via the CorvusPay payment method by supplying an arbitrary order number to the /wp-json/corvuspay/cancel/ REST endpoint.
Product
CorvusPay WooCommerce Payment Gateway
Affected
up to 2.7.4
What to do
Affects up to 2.7.4. Update CorvusPay WooCommerce Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2026CorvusPay WooCommerce Payment Gateway: Payment BypassCVE-2026-9027 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to Payment Bypass via Improper Verification of Cryptographic Signature in all versions up to, and including, 2.7.4. The `corvuspay_success_handler` function registers the REST endpoint `POST /wp-json/corvuspay/success/` with `'permission_callback' => '__return_true'`, and while it calls `$this->client->validate->signature()` and stores the boolean result in `$res`, the result is never evaluated in a conditional — it is only written to the debug log — causing execution to unconditionally reach `$order->payment_complete()` regardless of whether the cryptographic signature is valid. This makes it possible for unauthenticated attackers to mark any pending WooCommerce order as fully paid by sending a POST request to the success endpoint containing an arbitrary or forged signature value, allowing them to obtain goods or services without payment. Because WooCommerce order IDs are sequential integers, target orders are trivially enumerable via the `order_number` POST parameter, requiring no prior knowledge of the victim order.
Product
CorvusPay WooCommerce Payment Gateway
Affected
up to 2.7.4
What to do
Affects up to 2.7.4. Update CorvusPay WooCommerce Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2026Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails: Time-based SQL InjectionCVE-2026-14342 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to time-based SQL Injection via the 'contact_ids' parameter in all versions up to, and including, 1.24.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails
Affected
up to 1.24.2
What to do
Affects up to 1.24.2. Update Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2026Customer Reviews for WooCommerce: Stored Cross-Site ScriptingCVE-2026-13771 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'color' Shortcode Attribute in all versions up to, and including, 5.113.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Customer Reviews for WooCommerce
Affected
up to 5.113.0
What to do
Affects up to 5.113.0. Update Customer Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2026WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell: Local File InclusionCVE-2026-13080 · WordPress plugins & themes · reported by WordfenceMedium 6.6
The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.12.7 via the 'logKey' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Product
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
Affected
up to 3.12.7
What to do
Affects up to 3.12.7. Update WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2026ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support: Generic SQL InjectionCVE-2026-13011 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 1.17.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the erp_list_employee capability, which is granted to HR Manager-level users and above within the WP ERP plugin.
Product
ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support
Affected
up to 1.17.5
What to do
Affects up to 1.17.5. Update ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2026Memberships and User Profiles for WooCommerce – ProfileGrid WooCommerce Integration: Unauthorized plugin installation and activationCVE-2026-11359 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Memberships and User Profiles for WooCommerce – ProfileGrid WooCommerce Integration plugin for WordPress is vulnerable to unauthorized plugin installation and activation in versions up to, and including, 3.4. This is due to a missing capability check and missing nonce validation on the pg_install_profilegrid() AJAX handler registered via wp_ajax_pg_install_profilegrid. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate the ProfileGrid plugin from wordpress.
Product
Memberships and User Profiles for WooCommerce – ProfileGrid WooCommerce Integration
Affected
up to 3.4
What to do
Affects up to 3.4. Update Memberships and User Profiles for WooCommerce – ProfileGrid WooCommerce Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.