Vulnerabilities

TI-2026-67923 CVE-2026-32575 · GHSA-2563-mp24-9vpf

Cross-site scripting in WordPress SUMO Affiliates Pro plugin

LOW 31

Unauthenticated Cross Site Scripting (XSS) in SUMO Affiliates Pro <= 11.7.0 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.0023 Published 2026-10-06 No fix listed CWE-79

TI-2026-06623 CVE-2026-7534 · GHSA-j42q-gjcw-f29h

SUMO Reward Points for WooCommerce <= 32.7.0 - Unauthenticated Stored Cross-Site Scripting via 'reason' Parameter

LOW 38

The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REST API endpoint `/wp-json/wc-srp/v1/earning` in versions up to, and including, 32.7.0.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00318 Published 2026-07-23 No fix listed CWE-79

TI-2026-20174 CVE-2026-24989 · GHSA-5c9g-mh76-8jrw

WordPress SUMO Affiliates Pro plugin < 11.4.0 - PHP Object Injection vulnerability

MEDIUM 49

Deserialization of Untrusted Data vulnerability in FantasticPlugins SUMO Affiliates Pro affs allows Object Injection.This issue affects SUMO Affiliates Pro: from n/a through < 11.4.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00389 Published 2026-03-25 No fix listed CWE-502

TI-2025-39665 CVE-2025-64222 · GHSA-v3v9-4r58-fj96

WordPress WooCommerce Recover Abandoned Cart plugin <= 24.6.0 - Arbitrary Content Deletion vulnerability

LOW 39

Missing Authorization vulnerability in FantasticPlugins WooCommerce Recover Abandoned Cart rac allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Recover Abandoned Cart…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00292 Published 2025-12-18 No fix listed CWE-862

TI-2025-39671 CVE-2025-64228 · GHSA-8gx7-cf2h-mfwc

WordPress SUMO Affiliates Pro plugin <= 11.0.0 - Sensitive Data Exposure vulnerability

LOW 19

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in FantasticPlugins SUMO Affiliates Pro affs allows Retrieve Embedded Sensitive Data.This issue affects SUMO Affiliates Pro: from n…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00224 Published 2025-10-29 No fix listed CWE-497

TI-2025-38328 CVE-2025-62005 · GHSA-j55j-j468-484h

WordPress SUMO Memberships for WooCommerce plugin < 7.8.0 - Cross Site Request Forgery (CSRF) vulnerability

LOW 30

Cross-Site Request Forgery (CSRF) vulnerability in FantasticPlugins SUMO Memberships for WooCommerce sumomemberships allows Cross Site Request Forgery.This issue affects SUMO Memberships for WooCommerce: from n/a through…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00135 Published 2025-10-22 No fix listed CWE-352

TI-2025-37588 CVE-2025-60222 · GHSA-wwwh-93v4-hf5m

WordPress SUMO Memberships for WooCommerce plugin <= 7.8.0 - Privilege Escalation vulnerability

MEDIUM 40

Incorrect Privilege Assignment vulnerability in FantasticPlugins SUMO Memberships for WooCommerce sumomemberships allows Privilege Escalation.This issue affects SUMO Memberships for WooCommerce: from n/a through <= 7.8.0…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00391 Published 2025-10-22 No fix listed CWE-266

TI-2025-32807 CVE-2025-52757 · GHSA-66xg-mp3j-p8c5

WordPress SUMO Memberships for WooCommerce plugin < 7.8.0 - Arbitrary Content Deletion vulnerability

LOW 28

Missing Authorization vulnerability in FantasticPlugins SUMO Memberships for WooCommerce sumomemberships allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SUMO Memberships for Woo…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0027 Published 2025-10-22 No fix listed CWE-862

TI-2025-23388 CVE-2025-32291 · GHSA-66f8-mc6v-326v

WordPress SUMO Affiliates Pro plugin < 11.1.0 - Arbitrary File Upload vulnerability

MEDIUM 50

Unrestricted Upload of File with Dangerous Type vulnerability in FantasticPlugins SUMO Affiliates Pro affs allows Using Malicious Files.This issue affects SUMO Affiliates Pro: from n/a through < 11.1.0.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00541 Published 2025-06-09 No fix listed CWE-434

TI-2025-23946 CVE-2025-32925 · GHSA-33v4-3fqc-hxh5

WordPress SUMO Reward Points plugin <= 30.7.0 - Local File Inclusion vulnerability

MEDIUM 43

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in FantasticPlugins SUMO Reward Points rewardsystem allows PHP Local File Inclusion.This issue affects…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00489 Published 2025-05-19 No fix listed CWE-98

TI-2025-00811 CVE-2025-0956 · GHSA-q7m5-xq5p-7jq4

WooCommerce Recover Abandoned Cart <= 24.4.0 - Unauthenticated PHP Object Injection

LOW 38

The WooCommerce Recover Abandoned Cart plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 24.4.0 via deserialization of untrusted input from the 'raccookie_guest_email' cooki…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.0057 Published 2025-03-05 No fix listed CWE-502

TI-2023-10521 CVE-2023-25048 · GHSA-qqm5-7q57-5m9g

WordPress Fantastic Content Protector Free plugin <= 2.6 - Broken Access Control vulnerability

LOW 31

Missing Authorization vulnerability in Fantastic Plugins Fantastic Content Protector Free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fantastic Content Protector Free: from…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00568 Published 2024-12-09 No fix listed CWE-862

Vulnerabilities

Filters