Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 13

Export CSV
CVE-2024-30230

WordPress PDF Invoices and Packing Slips For WooCommerce plugin <= 1.3.7 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Acowebs PDF Invoices and Packing Slips For WooCommerce.This issue affects PDF Invoices and Packing Slips For WooCommerce: from n/a through 1.3.7.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Acowebs
Products
Pdf Invoices And Packing Slips For Woocommerce
CVE-2024-24886

WordPress Product Labels For Woocommerce Plugin <= 1.5.3 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Acowebs Product Labels For Woocommerce (Sale Badges) allows Stored XSS.This issue affects Product Labels For Woocommerce (Sale Badges): from n/a through 1.5.3.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Acowebs
Products
Product Labels For Woocommerce \(sale Badges\)
CVE-2025-47588

WordPress Dynamic Pricing With Discount Rules for WooCommerce plugin <= 4.5.9 - Arbitrary Code Execution vulnerability

Improper Control of Generation of Code ('Code Injection') vulnerability in acowebs Dynamic Pricing With Discount Rules for WooCommerce aco-woo-dynamic-pricing allows Code Injection.This issue affects Dynamic Pricing With Discount Rules for WooCommerce: from n/a through <= 4.5.9.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Acowebs Wordpress
Products
Dynamic Pricing With Discount Rules For Woocommerce Wordpress
CVE-2026-4001

Woocommerce Custom Product Addons Pro <= 5.4.1 - Unauthenticated Remote Code Execution via Custom Pricing Formula

The Woocommerce Custom Product Addons Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 5.4.1 via the custom pricing formula eval() in the process_custom_formula() function within includes/process/price.php. This is due to insufficient sanitization and validation of user-submitted field values before passing them to PHP's eval() function. The sanitize_values() method strips HTML tags but does not escape single quotes or prevent PHP code injection. This makes it possible for unauthenticated attackers to execute arbitrary code on the server by submitting a crafted value to a WCPA text field configured with custom pricing formula (pricingType: "custom" with {this.value}).

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Acowebs Wordpress
Products
Woocommerce Custom Product Addons Pro Wordpress
CVE-2025-47544

WordPress Dynamic Pricing With Discount Rules for WooCommerce plugin <= 4.5.8 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in acowebs Dynamic Pricing With Discount Rules for WooCommerce aco-woo-dynamic-pricing allows Blind SQL Injection.This issue affects Dynamic Pricing With Discount Rules for WooCommerce: from n/a through <= 4.5.8.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Acowebs
Products
Dynamic Pricing With Discount Rules For Woocommerce
CVE-2025-12087

Wishlist and Save for later for Woocommerce <= 1.1.22 - Insecure Direct Object Reference to Authenticated (Subscriber+) Wishlist Item Deletion

The Wishlist and Save for later for Woocommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.22 via the 'awwlm_remove_added_wishlist_page' AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete wishlist items from other user's wishlists.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Acowebs Wordpress
Products
Wishlist And Save For Later For Woocommerce Wordpress
CVE-2026-2296

Product Addons for Woocommerce – Product Options with Custom Fields <= 3.1.0 - Authenticated (Shop Manager+) Code Injection via Conditional Logic 'operator' Parameter

The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 3.1.0. This is due to insufficient input validation of the 'operator' field in conditional logic rules within the evalConditions() function, which passes unsanitized user input directly to PHP's eval() function. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject and execute arbitrary PHP code on the server via the conditional logic 'operator' parameter when saving addon form field rules.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Acowebs Wordpress
Products
Product Addons For Woocommerce – Product Options With Custom Fields Wordpress
CVE-2024-1773

PDF Invoices and Packing Slips For WooCommerce <= 1.3.7 - Authenticated (Subscriber+) PHP Object Injection

The PDF Invoices and Packing Slips For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.7 via deserialization of untrusted input via the order_id parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Acowebs
Products
Pdf Invoices And Packing Slips Pdf Invoices And Packing Slips For Woocommerce
CVE-2024-10638

Product Labels For Woocommerce < 1.5.11 - Admin+ SQLi

The Product Labels For Woocommerce (Sale Badges) WordPress plugin before 1.5.11 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
Acowebs
Products
Product Labels For Woocommerce \(sale Badges\)
CVE-2024-12109

Product Labels For Woocommerce < 1.5.9 - Admin+ SQLi

The Product Labels For Woocommerce (Sale Badges) WordPress plugin before 1.5.9 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
Acowebs
Products
Product Labels For Woocommerce \(sale Badges\)