Read the docs

flycart

Records5All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

flycart records in CISA KEV

No flycart vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Discount Rules For Woocommerce 2 records LOW

Records

5 records

TI-2026-24987 CVE-2026-32459 · GHSA-8rm3-c9m3-vvrx

WordPress UpsellWP plugin <= 2.2.4 - SQL Injection vulnerability

Priority LOW 36

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in flycart UpsellWP checkout-upsell-and-order-bumps allows Blind SQL Injection.This issue affects UpsellWP: from n/a thro…

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00231 Published 2026-03-13 No fix listed CWE-89
TI-2022-01934 CVE-2022-2090 · GHSA-mc26-m43p-75hh

Woo Discount Rules < 2.4.2 - Reflected Cross-Site Scripting

Priority LOW 29

The Discount Rules for WooCommerce WordPress plugin before 2.4.2 does not escape a parameter before outputting it back in an attribute of the plugin's discount rule page, leading to Reflected Cross-Site Scripting

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00788 Published 2022-07-17 Fixed in 2.4.2 CWE-79
TI-2024-07918 CVE-2024-8541 · GHSA-mjqf-c8r8-gxjg

Cross-site scripting in flycart Discount Rules for WooCommerce

Priority LOW 28

The Discount Rules for WooCommerce – Create Smart WooCommerce Coupons & Discounts, Bulk Discount, BOGO Coupons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00436 Published 2024-10-16 No fix listed CWE-79
TI-2020-18969 CVE-2020-36834 · GHSA-fpvw-jg53-vrvc

Discount Rules for WooCommerce <= 2.0.2 - Missing Authorization

Priority LOW 28

The Discount Rules for WooCommerce plugin for WordPress is vulnerable to missing authorization via several AJAX actions in versions up to, and including, 2.0.2 due to missing capability checks on various functions.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00354 Published 2024-10-16 No fix listed CWE-862
TI-2026-20536 CVE-2026-25419 · GHSA-2mwh-gp93-cff3

WordPress UpsellWP plugin <= 2.2.5 - Broken Access Control vulnerability

Priority LOW 19

Missing Authorization vulnerability in flycart UpsellWP checkout-upsell-and-order-bumps allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UpsellWP: from n/a through <= 2.2.5.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00229 Published 2026-02-19 No fix listed CWE-862
Open these records in search →