Poznaj podatności. Chroń swoje aplikacje.

Krytyczna 17.10.2025

CVE-2025-11391

PPOM – Product Addons & Custom Fields for WooCommerce do wersji 33.0.15 włącznie – nieuwierzytelnione przesyłanie dowolnych plików

Błąd we wtyczce PPOM – Product Addons & Custom Fields for WooCommerce pozwala nieuwierzytelnionym atakującym przesyłać dowolne pliki na serwer z powodu braku walidacji typu pliku, co może umożliwić zdalne wykonanie kodu na stronach z aktywną wersją płatną.

WordPress

woocommerce-product-addon

Średnia 17.10.2025

CVE-2025-11742

WPC Smart Wishlist for WooCommerce <= 5.0.4 - Missing Authorization to Authenticated (Subscriber+) Information Exposure

WordPress

woo-smart-wishlist

Wysoka 16.10.2025

CVE-2025-62008

Product Table For WooCommerce <= 1.2.4 - Authenticated (Contributor+) PHP Object Injection

WordPress

product-table-for-woocommerce

Średnia 16.10.2025

CVE-2025-62006

WP SMS <= 7.0.1 - Missing Authorization

WordPress

wp-sms

Średnia 16.10.2025

CVE-2025-62015

Advanced Coupons for WooCommerce Coupons <= 4.6.8 - Authenticated (Shop manager+) SQL Injection

WordPress

advanced-coupons-for-woocommerce-free

Średnia 16.10.2025

CVE-2025-62028

Salient < 17.4.0 - Missing Authorization

WordPress

salient

Średnia 15.10.2025

CVE-2025-59556

GoStore < 1.6.4 - Reflected Cross-Site Scripting

WordPress

gostore

Średnia 15.10.2025

CVE-2025-62957

NikanWP WooCommerce Reporting <= 1.0.0 - Cross-Site Request Forgery

WordPress

wc-reports-lite

Średnia 15.10.2025

CVE-2025-10567

FunnelKit <= 3.12.0 - Reflected Cross-Site Scripting

WordPress

funnel-builder

Wysoka 15.10.2025

CVE-2025-59578

Free Follow-Up Emails & Marketing Automation for WooCommerce – ShopMagic <= 4.5.6 - Unauthenticated Information Exposure

WordPress

shopmagic-for-woocommerce

Średnia 15.10.2025

CVE-2025-62005

SUMO Memberships for WooCommerce < 7.8.0 - Cross-Site Request Forgery

WordPress

sumomemberships

Wysoka 14.10.2025

CVE-2025-11722

Category and Products Accordion Panel <= 1.0 - Authenticated (Contributor+) Local File Inclusion

WordPress

accordion-panel-for-category-and-products

Średnia 14.10.2025

CVE-2025-11728

Oceanpayment CreditCard Gateway <= 6.0 - Missing Authentication to Unauthenticated Order Status Update

WordPress

oceanpayment-creditcard-gateway

Wysoka 14.10.2025

CVE-2025-11746

XStore | Multipurpose WooCommerce Theme <= 9.5.4 - Authenticated (Subscriber+) Local File Inclusion

WordPress

xstore

Wysoka 12.10.2025

CVE-2025-62041

TheGem (Elementor) <= 5.10.5.1 - Unauthenticated Stored Cross-Site Scripting

WordPress

thegem-elementor

Średnia 11.10.2025

CVE-2025-58964

Enzy < 1.6.4 - Reflected Cross-Site Scripting

WordPress

enzy

Średnia 10.10.2025

CVE-2025-10167

Stock History & Reports Manager for WooCommerce <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

WordPress

stock-snapshot-for-woocommerce

Krytyczna 10.10.2025

CVE-2025-6439

WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File Deletion

WordPress

wc-designer-pro

Średnia 10.10.2025

CVE-2025-11518

WPC Smart Wishlist for WooCommerce <= 5.0.3 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation

WordPress

woo-smart-wishlist

Średnia 09.10.2025

CVE-2025-53218

AppExperts <= 1.4.5 - Unauthenticated Sensitive Information Exposure

WordPress

appexperts

Średnia 08.10.2025

CVE-2025-62935

Open Close WooCommerce Store <= 5.0.1 - Missing Authorization

WordPress

woc-open-close

Średnia 08.10.2025

CVE-2025-59001

Salient Core <= 3.0.8 - Missing Authorization

WordPress

salient-core

Wysoka 08.10.2025

CVE-2025-10862

Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers <= 2.1.3 - Unauthenticated SQL Injection via 'id'

WordPress

popup-builder-block

Średnia 05.10.2025

CVE-2025-62925

Conversios.io <= 7.2.13 - Missing Authorization

WordPress

enhanced-e-commerce-for-woocommerce-store