Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 29

Export CSV
CVE-2025-22713

WordPress WooCommerce Orders & Customers Exporter plugin <= 5.4 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in vanquish WooCommerce Orders & Customers Exporter woocommerce-orders-ei allows SQL Injection.This issue affects WooCommerce Orders & Customers Exporter: from n/a through <= 5.4.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Vanquish Wordpress
Products
Woocommerce Orders Customers Exporter Wordpress
CVE-2025-53424

WordPress WooCommerce Orders & Customers Exporter plugin <= 5.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in vanquish WooCommerce Orders & Customers Exporter woocommerce-orders-ei allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Orders & Customers Exporter: from n/a through <= 5.4.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Vanquish Woocommerce Wordpress
Products
Woocommerce Orders Customers Exporter Woocommerce Wordpress
CVE-2026-32522

WordPress WooCommerce Support Ticket System plugin < 18.5 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanquish WooCommerce Support Ticket System woocommerce-support-ticket-system allows Path Traversal.This issue affects WooCommerce Support Ticket System: from n/a through < 18.5.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Vanquish Wordpress
Products
Woocommerce Support Ticket System Wordpress
CVE-2026-27374

WordPress WooCommerce Order Details plugin <= 3.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in vanquish WooCommerce Order Details woocommerce-order-details allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Order Details: from n/a through <= 3.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Vanquish Wordpress
Products
Woocommerce Order Details Wordpress
CVE-2025-7846

WordPress User Extra Fields <= 16.7 - Authenticated (Subscriber+) Arbitrary File Deletion via save_fields Function

The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the save_fields() function in all versions up to, and including, 16.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Vanquish Wordpress
Products
Wordpress User Extra Fields Wordpress
CVE-2025-69379

WordPress Upload Files Anywhere plugin <= 2.8 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanquish Upload Files Anywhere wp-upload-files-anywhere allows Path Traversal.This issue affects Upload Files Anywhere: from n/a through <= 2.8.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Vanquish Wordpress
Products
Upload Files Anywhere Wordpress
CVE-2024-10801

WordPress User Extra Fields <= 16.5 - Unauthenticated Arbitrary File Upload

The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_manage_file_chunk_upload() function in all versions up to, and including, 16.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. User registration must be enabled for this to be exploited.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Vanquish
Products
Wordpress User Extra Fields
CVE-2025-69381

WordPress WooCommerce Bulk Product Editor plugin <= 3.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in vanquish WooCommerce Bulk Product Editor woocommerce-quick-product-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Bulk Product Editor: from n/a through <= 3.0.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Vanquish Wordpress
Products
Woocommerce Bulk Product Editor Wordpress
CVE-2025-67579

WordPress User Extra Fields plugin <= 16.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Extra Fields: from n/a through <= 16.8.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Vanquish Wordpress
Products
User Extra Fields Wordpress
CVE-2025-67991

WordPress User Extra Fields plugin <= 16.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Reflected XSS.This issue affects User Extra Fields: from n/a through <= 16.8.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Vanquish Wordpress
Products
User Extra Fields Wordpress
CVE-2025-69376

WordPress User Extra Fields plugin <= 17.0 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Path Traversal.This issue affects User Extra Fields: from n/a through <= 17.0.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Vanquish Wordpress
Products
User Extra Fields Wordpress
CVE-2025-69377

WordPress User Extra Fields plugin <= 17.0 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Path Traversal.This issue affects User Extra Fields: from n/a through <= 17.0.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Vanquish Wordpress
Products
User Extra Fields Wordpress
CVE-2025-69380

WordPress Upload Files Anywhere plugin <= 2.8 - Arbitrary File Download vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanquish Upload Files Anywhere wp-upload-files-anywhere allows Path Traversal.This issue affects Upload Files Anywhere: from n/a through <= 2.8.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Vanquish Wordpress
Products
Upload Files Anywhere Wordpress
CVE-2024-10626

WooCommerce Support Ticket System <= 17.7 - Authenticated (Subscriber+) Arbitrary File Deletion

The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_uploaded_file() function in all versions up to, and including, 17.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Support Ticket System Project Vanquish
Products
Support Ticket System Woocommerce Support Ticket System
CVE-2024-10625

WooCommerce Support Ticket System <= 17.7 - Unauthenticated Arbitrary File Deletion

The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_tmp_uploaded_file() function in all versions up to, and including, 17.7. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

CVSS 3.1 · 9.8 Critical EPSS 1.0% KEV · Not listed
Vendors
Support Ticket System Project Vanquish
Products
Support Ticket System Woocommerce Support Ticket System
CVE-2024-10820

WooCommerce Upload Files <= 84.3 - Unauthenticated Arbitrary File Upload

The WooCommerce Upload Files plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload_files() function in all versions up to, and including, 84.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVSS 3.1 · 9.8 Critical EPSS 1.2% KEV · Not listed
Vendors
Vanquish Woocommerce
Products
Woocommerce Upload Files Upload Files
CVE-2024-11150

WordPress User Extra Fields <= 16.6 - Unauthenticated Arbitrary File Deletion

The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_tmp_uploaded_file() function in all versions up to, and including, 16.6. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

CVSS 3.1 · 9.8 Critical EPSS 1.4% KEV · Not listed
Vendors
Vanquish
Products
User Extra Fields Wordpress User Extra Fields
CVE-2024-10800

WordPress User Extra Fields <= 16.6 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

The WordPress User Extra Fields plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the ajax_save_fields() function in all versions up to, and including, 16.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to add custom fields that can be updated and then use the check_and_overwrite_wp_or_woocommerce_fields function to update the wp_capabilities field to have administrator privileges.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Vanquish
Products
User Extra Fields Wordpress User Extra Fields
CVE-2024-13775

WooCommerce Support Ticket System <= 17.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Information Exposure

The WooCommerce Support Ticket System plugin for WordPress is vulnerable to unauthorized access and loss of data due to missing capability checks on the 'ajax_delete_message', 'ajax_get_customers_partial_list', and 'ajax_get_admins_list' functions in all versions up to, and including, 17.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary posts, and read names, emails, and capabilities of all users.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Vanquish
Products
Woocommerce Support Ticket System