Conoce las vulnerabilidades. Protege tus aplicaciones.

Crítica 17.10.2025

CVE-2025-11391

PPOM – Product Addons & Custom Fields for WooCommerce <= 33.0.15 - Subida de archivos arbitrarios sin autenticación

Una vulnerabilidad en PPOM – Product Addons & Custom Fields for WooCommerce permite a atacantes no autenticados subir archivos arbitrarios mediante el recorte de imágenes, posibilitando la ejecución de código en sitios con la versión de pago activa.

WordPress

woocommerce-product-addon

Media 17.10.2025

CVE-2025-11742

WPC Smart Wishlist for WooCommerce <= 5.0.4 - Missing Authorization to Authenticated (Subscriber+) Information Exposure

WordPress

woo-smart-wishlist

Alta 16.10.2025

CVE-2025-62008

Product Table For WooCommerce <= 1.2.4 - Authenticated (Contributor+) PHP Object Injection

WordPress

product-table-for-woocommerce

Media 16.10.2025

CVE-2025-62006

WP SMS <= 7.0.1 - Missing Authorization

WordPress

wp-sms

Media 16.10.2025

CVE-2025-62015

Advanced Coupons for WooCommerce Coupons <= 4.6.8 - Authenticated (Shop manager+) SQL Injection

WordPress

advanced-coupons-for-woocommerce-free

Media 16.10.2025

CVE-2025-62028

Salient < 17.4.0 - Missing Authorization

WordPress

salient

Media 15.10.2025

CVE-2025-59556

GoStore < 1.6.4 - Reflected Cross-Site Scripting

WordPress

gostore

Media 15.10.2025

CVE-2025-62957

NikanWP WooCommerce Reporting <= 1.0.0 - Cross-Site Request Forgery

WordPress

wc-reports-lite

Media 15.10.2025

CVE-2025-10567

FunnelKit <= 3.12.0 - Reflected Cross-Site Scripting

WordPress

funnel-builder

Alta 15.10.2025

CVE-2025-59578

Free Follow-Up Emails & Marketing Automation for WooCommerce – ShopMagic <= 4.5.6 - Unauthenticated Information Exposure

WordPress

shopmagic-for-woocommerce

Media 15.10.2025

CVE-2025-62005

SUMO Memberships for WooCommerce < 7.8.0 - Cross-Site Request Forgery

WordPress

sumomemberships

Alta 14.10.2025

CVE-2025-11722

Category and Products Accordion Panel <= 1.0 - Authenticated (Contributor+) Local File Inclusion

WordPress

accordion-panel-for-category-and-products

Media 14.10.2025

CVE-2025-11728

Oceanpayment CreditCard Gateway <= 6.0 - Missing Authentication to Unauthenticated Order Status Update

WordPress

oceanpayment-creditcard-gateway

Alta 14.10.2025

CVE-2025-11746

XStore | Multipurpose WooCommerce Theme <= 9.5.4 - Authenticated (Subscriber+) Local File Inclusion

WordPress

xstore

Alta 12.10.2025

CVE-2025-62041

TheGem (Elementor) <= 5.10.5.1 - Unauthenticated Stored Cross-Site Scripting

WordPress

thegem-elementor

Media 11.10.2025

CVE-2025-58964

Enzy < 1.6.4 - Reflected Cross-Site Scripting

WordPress

enzy

Media 10.10.2025

CVE-2025-10167

Stock History & Reports Manager for WooCommerce <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

WordPress

stock-snapshot-for-woocommerce

Crítica 10.10.2025

CVE-2025-6439

WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File Deletion

WordPress

wc-designer-pro

Media 10.10.2025

CVE-2025-11518

WPC Smart Wishlist for WooCommerce <= 5.0.3 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation

WordPress

woo-smart-wishlist

Media 09.10.2025

CVE-2025-53218

AppExperts <= 1.4.5 - Unauthenticated Sensitive Information Exposure

WordPress

appexperts

Media 08.10.2025

CVE-2025-62935

Open Close WooCommerce Store <= 5.0.1 - Missing Authorization

WordPress

woc-open-close

Media 08.10.2025

CVE-2025-59001

Salient Core <= 3.0.8 - Missing Authorization

WordPress

salient-core

Alta 08.10.2025

CVE-2025-10862

Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers <= 2.1.3 - Unauthenticated SQL Injection via 'id'

WordPress

popup-builder-block

Media 05.10.2025

CVE-2025-62925

Conversios.io <= 7.2.13 - Missing Authorization

WordPress

enhanced-e-commerce-for-woocommerce-store