Vulnerabilities

TI-2026-67835 CVE-2026-103349 · GHSA-mchg-wqjh-wq83

PHP object injection in Product Feed PRO for WooCommerce plugin

LOW 34

Deserialization of Untrusted Data vulnerability in Rymera Web Co Product Feed PRO for WooCommerce woo-product-feed-pro allows Object Injection.This issue affects Product Feed PRO for WooCommerce: from n/a through 13.5.7.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00385 Published 2026-10-05 No fix listed CWE-502

TI-2026-39641 CVE-2026-54838 · GHSA-837c-38p7-p5rv

WordPress WC Vendors Marketplace plugin <= 2.6.8 - SQL Injection vulnerability

LOW 37

Subscriber SQL Injection in WC Vendors Marketplace <= 2.6.8 versions.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00357 Published 2026-06-25 No fix listed CWE-89

TI-2026-21934 CVE-2026-27540 · GHSA-hw97-rjpm-g922

WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Arbitrary File Upload vulnerability

MEDIUM 46

Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd.

CVSS 3.1CRITICAL 9.0 Network No auth No interaction EPSS 0.02747 Published 2026-03-19 No fix listed CWE-434

TI-2026-21936 CVE-2026-27542 · GHSA-6xqr-w87w-hx3g

WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Privilege Escalation vulnerability

MEDIUM 52

Incorrect Privilege Assignment vulnerability in Rymera Web Co Pty Ltd.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01776 Published 2026-03-19 No fix listed CWE-266

TI-2024-25979 CVE-2024-38745 · GHSA-x6v8-64jx-q6q8

WordPress Wholesale Suite plugin <= 2.1.12 - Broken Access Control vulnerability

LOW 31

Missing Authorization vulnerability in Rymera Web Co Wholesale Suite allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Wholesale Suite: from n/a through 2.1.12.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00485 Published 2024-11-01 No fix listed CWE-862

TI-2024-01610 CVE-2024-1731 · GHSA-hjp2-wg69-g55x

Auto Refresh Single Page <= 1.1 - Authenticated (Contributor+) PHP Object Injection

MEDIUM 42

The Auto Refresh Single Page plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1 via deserialization of untrusted input from the arsp_options post meta option.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00851 Published 2024-03-05 No fix listed CWE-502

TI-2022-15248 CVE-2022-34344 · GHSA-69wm-cjpw-r4qm

WordPress Wholesale Suite Plugin <= 2.1.5 is vulnerable to Broken Access Control

LOW 38

Missing Authorization vulnerability in Rymera Web Co Wholesale Suite – WooCommerce Wholesale Prices, B2B, Catalog Mode, Order Form, Wholesale User Roles, Dynamic Pricing & More.This issue affects Wholesale Suite – WooCom…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0046 Published 2024-01-08 No fix listed CWE-862

TI-2022-20037 CVE-2022-41640 · GHSA-m56w-85v9-828h

WordPress Wholesale Suite Plugin <= 2.1.5 is vulnerable to Cross Site Scripting (XSS)

LOW 29

Auth. (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in Rymera Web Co Wholesale Suite plugin <= 2.1.5 versions.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00383 Published 2023-05-09 No fix listed CWE-79

TI-2022-21271 CVE-2022-43481 · GHSA-xpr7-cmp4-v4v3

WordPress Advanced Coupons for WooCommerce Coupons plugin <= 4.5 - Cross-Site Request Forgery (CSRF) vulnerability

LOW 24

Cross-Site Request Forgery (CSRF) vulnerability in Advanced Coupons for WooCommerce Coupons plugin <= 4.5 on WordPress leading to notice dismissal.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00337 Published 2022-11-08 No fix listed CWE-352

Vulnerabilities

Filters