Premmerce vulnerabilities, page 2

31 vulnerabilities

Known vulnerabilities in Premmerce products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 15 products.

9.3CVE-2026-54849premmercepremmerce wishlist for woocommerce+1
EPSS score
0.40%
Unauthenticated SQL Injection in Premmerce Wishlist for WooCommerce <= 1.1.11 versions.6.4CVE-2026-0555premmercepremmerce+1
EPSS score
0.27%
The Premmerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'premmerce_wizard_actions' AJAX endpoint in all versions up to, and including, 1.3.20. This is due to missing capability checks and insufficient input sanitization and output escaping on the `state` parameter. This makes it possible for authenticated attackers, with subscriber level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page (the Premmerce Wizard admin page).6.5CVE-2026-32541premmercepremmerce_redirect_manager+1
EPSS score
0.23%
Missing Authorization vulnerability in Premmerce Premmerce Redirect Manager premmerce-redirect-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premmerce Redirect Manager: from n/a through <= 1.0.12.8.8CVE-2026-6933premmercepremmerce dev tools+1
EPSS score
1.05%
The Premmerce Dev Tools plugin for WordPress is vulnerable to Remote Code Execution via missing authorization in versions up to and including 2.0. This is due to the 'generatePluginHandler' function lacking any authorization check before processing user-supplied POST data, combined with the 'createFromStub' function performing unsanitized string substitution of the 'premmerce_plugin_namespace' parameter directly into PHP stub files written to the wp-content/plugins/ directory. An attacker can inject a semicolon followed by arbitrary PHP code into the namespace parameter, causing the generated plugin file to contain and execute that code when accessed via HTTP. This makes it possible for authenticated attackers with Subscriber-level access and above to create arbitrary PHP files on the server and achieve remote code execution.7.2CVE-2026-97273premmercepremmerce wishlist for woocommerce+1
EPSS score
0.18%
Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.7.2CVE-2026-97272premmercepremmerce permalink manager for woocommerce+1
EPSS score
0.15%
Unauthenticated Cross Site Scripting (XSS) in Premmerce Permalink Manager for WooCommerce <= 2.3.13 versions.7.2CVE-2026-97268premmercepremmerce wishlist for woocommerce+1
EPSS score
0.18%
Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.8.3CVE-2023-41130premmercepremmerce user roles+1
EPSS score
0.61%
Missing Authorization vulnerability in Premmerce Premmerce User Roles premmerce-user-roles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premmerce User Roles: from n/a through <= 1.0.12.5.9CVE-2023-23789premmercepremmerce_redirect_manager+1
EPSS score
0.37%
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Premmerce Premmerce Redirect Manager plugin <= 1.0.9 versions.8.8CVE-2023-23719premmercepremmerce+1
EPSS score
0.26%
Cross-Site Request Forgery (CSRF) vulnerability in Premmerce plugin <= 1.3.17 versions.8.8CVE-2023-23787premmercepremmerce_redirect_manager+2
EPSS score
0.32%
Cross-Site Request Forgery (CSRF) vulnerability in Premmerce Premmerce Redirect Manager plugin <= 1.0.9 versions.