Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

14 records

Vendor: StoreApps Clear all filters
TI-2026-67457 CVE-2026-18443 · GHSA-c5cw-fc86-6h2j

SQL injection in StoreApps Smart Manager – WooCommerce Bulk Edit: Products, Orders, Users…

Priority MEDIUM 40

The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via the 'access_privileges' parameter in all versions up to, and including, 8.97.0 due…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00366 Published 2026-10-03 No fix listed CWE-89
TI-2026-19638 CVE-2026-24365 · GHSA-m6vh-c57v-xqg7

WordPress Stock Manager for WooCommerce plugin < 3.6.0 - Cross Site Request Forgery (CSRF) vulnerability

Priority LOW 23

Cross-Site Request Forgery (CSRF) vulnerability in storeapps Stock Manager for WooCommerce woocommerce-stock-manager allows Cross Site Request Forgery.This issue affects Stock Manager for WooCommerce: from n/a through <…

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00116 Published 2026-01-22 No fix listed CWE-352
TI-2025-16592 CVE-2025-22710 · GHSA-h738-p7mj-mggx

WordPress Smart Manager Plugin <= 8.52.0 - SQL Injection vulnerability

Priority LOW 35

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in storeapps Smart Manager smart-manager-for-wp-e-commerce allows Blind SQL Injection.This issue affects Smart Manager: f…

CVSS 3.1HIGH 7.6 Network High privileges No interaction EPSS 0.01028 Published 2025-01-21 No fix listed CWE-89
TI-2023-05207 CVE-2023-5663 · GHSA-xr8x-4f65-m34g

News Announcement Scroll <= 9.0.0 - Authenticated (Contributor+) SQL Injection via Shortcode

Priority MEDIUM 41

The News Announcement Scroll plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 9.0.0 due to insufficient escaping on the user supplied parameter and lack of…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00773 Published 2024-03-13 No fix listed CWE-89
TI-2024-00524 CVE-2024-0566 · GHSA-44pg-8763-mhc9

Smart Manager < 8.28.0 - Admin+ SQL Injection

Priority HIGH 67

The Smart Manager WordPress plugin before 8.28.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.03301 Published 2024-02-12 Fixed in 8.28.0 CWE-89
TI-2022-16640 CVE-2022-36284 · GHSA-f8cv-rhqg-3x6w

Authorization bypass in StoreApps Affiliate For WooCommerce

Priority LOW 30

Authenticated IDOR vulnerability in StoreApps Affiliate For WooCommerce premium plugin <= 4.7.0 at WordPress allows an attacker to change the PayPal email.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00651 Published 2022-08-05 No fix listed CWE-639
TI-2021-07118 CVE-2021-24836 · GHSA-x8f8-g3c4-95m3

Temporary Login Without Password < 1.7.1 - Subscriber+ Plugin's Settings Update

Priority LOW 20

The Temporary Login Without Password WordPress plugin before 1.7.1 does not have authorisation and CSRF checks when updating its settings, which could allows any logged-in users, such as subscribers to update them

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00358 Published 2021-12-13 Fixed in 1.7.1 CWE-352
TI-2021-13633 CVE-2021-34619 · GHSA-mvp7-wp4v-3h3h

Cross-Site Request Forgery in WooCommerce Stock Manager WordPress Plugin

Priority LOW 39

The WooCommerce Stock Manager WordPress plugin is vulnerable to Cross-Site Request Forgery leading to Arbitrary File Upload in versions up to, and including, 2.5.7 due to missing nonce and file validation in the /woocomm…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00719 Published 2021-07-21 No fix listed CWE-352