CVE-2025-63015

WordPress WooCommerce Payment Gateway – Paysera plugin <= 3.10.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in paysera WooCommerce Payment Gateway - Paysera woo-payment-gateway-paysera allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Payment Gateway - Paysera: from n/a through <= 3.10.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Paysera Woocommerce Wordpress

Products

Woocommerce Payment Gateway Woocommerce Wordpress

CVE-2025-63023

WordPress Payment Gateway for PayPal on WooCommerce plugin <= 9.0.53 - Broken Access Control vulnerability

Missing Authorization vulnerability in Easy Payment Payment Gateway for PayPal on WooCommerce woo-paypal-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment Gateway for PayPal on WooCommerce: from n/a through <= 9.0.53.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Easy Payment Woocommerce Wordpress

Products

Payment Gateway For Paypal On Woo Commerce Woocommerce Wordpress

CVE-2025-64638

WordPress OnPay.io for WooCommerce plugin <= 1.0.47 - Broken Access Control vulnerability

Missing Authorization vulnerability in OnPay.io OnPay.io for WooCommerce onpay-io-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects OnPay.io for WooCommerce: from n/a through <= 1.0.47.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Onpay.io Woocommerce Wordpress

Products

For Woocommerce Woocommerce Wordpress

CVE-2025-60247

WordPress Bux Woocommerce plugin <= 1.2.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Bux Bux Woocommerce bux-woocommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Bux Woocommerce: from n/a through <= 1.2.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Bux Woocommerce Wordpress

Products

Bux Woocommerce Woocommerce Wordpress

CVE-2025-64267

WordPress WooCommerce Ultimate Points And Rewards plugin <= 2.10.2 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPSwings WooCommerce Ultimate Points And Rewards woocommerce-ultimate-points-and-rewards allows Retrieve Embedded Sensitive Data.This issue affects WooCommerce Ultimate Points And Rewards: from n/a through <= 2.10.2.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Woocommerce Wordpress Wpswings

Products

Woocommerce Wordpress Ultimate Points And Rewards

CVE-2025-60071

WordPress Riode | Multi-Purpose WooCommerce theme <= 1.6.23 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in don-themes Riode riode allows PHP Local File Inclusion.This issue affects Riode: from n/a through <= 1.6.23.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Don-themes Woocommerce Wordpress

Products

Riode Woocommerce Wordpress

CVE-2025-60083

WordPress PDF Invoice Builder for WooCommerce plugin <= 6.5.0 - Deserialization of untrusted data vulnerability

Deserialization of Untrusted Data vulnerability in add-ons.org PDF Invoice Builder for WooCommerce pdf-for-woocommerce allows Object Injection.This issue affects PDF Invoice Builder for WooCommerce: from n/a through <= 6.5.0.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Add-ons.org Woocommerce Wordpress

Products

Pdf Invoice Builder For Woocommerce Woocommerce Wordpress

CVE-2025-64222

WordPress WooCommerce Recover Abandoned Cart plugin <= 24.6.0 - Arbitrary Content Deletion vulnerability

Missing Authorization vulnerability in FantasticPlugins WooCommerce Recover Abandoned Cart rac allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Recover Abandoned Cart: from n/a through <= 24.6.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Fantasticplugins Woocommerce Wordpress

Products

Woocommerce Recover Abandoned Cart Woocommerce Wordpress

CVE-2025-68528

WordPress Free Shipping Bar: Amount Left for Free Shipping for WooCommerce plugin <= 2.4.9 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Free Shipping Bar: Amount Left for Free Shipping for WooCommerce amount-left-free-shipping-woocommerce allows Stored XSS.This issue affects Free Shipping Bar: Amount Left for Free Shipping for WooCommerce: from n/a through <= 2.4.9.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Woocommerce Wordpress Wpfactory

Products

Woocommerce Wordpress Free Shipping Bar

CVE-2025-67958

WordPress TaxCloud for WooCommerce plugin <= 8.3.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in Taxcloud TaxCloud for WooCommerce simple-sales-tax allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TaxCloud for WooCommerce: from n/a through <= 8.3.8.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Taxcloud Woocommerce Wordpress

Products

Taxcloud For Woocommerce Woocommerce Wordpress

CVE-2025-68013

WordPress Payment Gateway Authorize.Net CIM for WooCommerce plugin <= 2.1.2 - Arbitrary Content Deletion vulnerability

Missing Authorization vulnerability in cardpaysolutions Payment Gateway Authorize.Net CIM for WooCommerce authnet-cim-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment Gateway Authorize.Net CIM for WooCommerce: from n/a through <= 2.1.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Cardpaysolutions Woocommerce Wordpress

Products

Payment Gateway Authorize.net Cim For Woocommerce Woocommerce Wordpress

CVE-2026-1710

WooPayments <= 10.5.1 - Missing Authorization to Unauthenticated Plugin Settings Update via save_upe_appearance_ajax

The WooPayments: Integrated WooCommerce Payments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_upe_appearance_ajax' function in all versions up to, and including, 10.5.1. This makes it possible for unauthenticated attackers to update plugin settings.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Woocommerce Wordpress

Products

Woopayments: Integrated Woocommerce Payments Wordpress

CVE-2026-24606

WordPress Bayarcash WooCommerce plugin <= 4.3.13 - Broken Access Control vulnerability

Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bayarcash WooCommerce: from n/a through <= 4.3.13.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Web Impian Woocommerce Wordpress

Products

Bayarcash Woo Commerce Woocommerce Wordpress

CVE-2025-68994

WordPress Product Loops for WooCommerce plugin <= 2.1.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in XforWooCommerce Product Loops for WooCommerce product-loops allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Loops for WooCommerce: from n/a through <= 2.1.2.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Woocommerce Wordpress Xforwoocommerce

Products

Woocommerce Wordpress Product Loops

CVE-2025-68993

WordPress Share, Print and PDF Products for WooCommerce plugin <= 3.1.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in XforWooCommerce Share, Print and PDF Products for WooCommerce share-print-pdf-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Share, Print and PDF Products for WooCommerce: from n/a through <= 3.1.2.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Woocommerce Wordpress Xforwoocommerce

Products

Woocommerce Wordpress Share, Print And Pdf Products

CVE-2025-67945

WordPress MailerLite – WooCommerce integration plugin <= 3.1.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MailerLite MailerLite – WooCommerce integration woo-mailerlite allows SQL Injection.This issue affects MailerLite – WooCommerce integration: from n/a through <= 3.1.2.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Mailerlite Woocommerce Wordpress

Products

Mailerlite Woocommerce Wordpress

CVE-2025-67580

WordPress Constant Contact + WooCommerce plugin <= 2.4.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Constant Contact Constant Contact + WooCommerce constant-contact-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Constant Contact + WooCommerce: from n/a through <= 2.4.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Woocommerce Wordpress

Products

Woocommerce Wordpress

CVE-2025-66128

WordPress Sendinblue for WooCommerce plugin <= 4.0.49 - Broken Access Control vulnerability

Missing Authorization vulnerability in Brevo Sendinblue for WooCommerce woocommerce-sendinblue-newsletter-subscription allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sendinblue for WooCommerce: from n/a through <= 4.0.49.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Brevo Woocommerce Wordpress

Products

Sendinblue For Woocommerce Woocommerce Wordpress

CVE-2025-66114

WordPress Show Variations as Single Products Woocommerce plugin <= 2.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in theme funda Show Variations as Single Products Woocommerce woo-show-single-variations-shop-category allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Show Variations as Single Products Woocommerce: from n/a through <= 2.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Theme Funda Woocommerce Wordpress

Products

Show Variations As Single Products Woocommerce Woocommerce Wordpress

CVE-2025-66109

WordPress Cart Weight for WooCommerce plugin <= 1.9.11 - Broken Access Control vulnerability

Missing Authorization vulnerability in Octolize Shipping Plugins Cart Weight for WooCommerce woo-cart-weight allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cart Weight for WooCommerce: from n/a through <= 1.9.11.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Octolize Woocommerce Wordpress

Products

Cart Weight For Woocommerce Woocommerce Wordpress