Tychesoftwares vulnerabilities
50 vulnerabilities
Known vulnerabilities in Tychesoftwares products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 14 products.
Products
14- Arconix Shortcodes10 vulnerabilities
- Print Invoice \& Delivery Notes For Woocommerce9 vulnerabilities
- Order Delivery Date For Woocommerce8 vulnerabilities
- Abandoned Cart Lite For Woocommerce7 vulnerabilities
- Arconix Faq3 vulnerabilities
- Product Delivery Date For Woocommerce – Lite3 vulnerabilities
- Product Input Fields For Woocommerce3 vulnerabilities
- Custom Order Numbers For Woocommerce2 vulnerabilities
- Order Delivery Date For Wp E Commerce2 vulnerabilities
- Abandoned Cart Pro For Woocommerce1 vulnerabilities
- Call For Price For Woocommerce1 vulnerabilities
- Order Delivery Date Pro For Woocommerce1 vulnerabilities
- Payment Gateway Based Fees And Discounts For Woocommerce1 vulnerabilities
- Product Delivery Date For Woocommerce1 vulnerabilities
CVE-2021-4414tychesoftwaresabandoned_cart_lite_for_woocommerce+1
EPSS score0.38%
The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.8.5. This is due to missing or incorrect nonce validation on the wcal_preview_emails() function. This makes it possible for unauthenticated attackers to generate email preview templates via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.CVE-2025-63024tychesoftwaresorder_delivery_date_for_woocommerce+1EPSS score0.23%
Missing Authorization vulnerability in tychesoftwares Order Delivery Date for WooCommerce order-delivery-date-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Delivery Date for WooCommerce: from n/a through <= 4.3.1.CVE-2025-2907tychesoftwaresorder_delivery_date_pro_for_woocommerce+2EPSS score1.39%
The Order Delivery Date WordPress plugin before 12.3.1 does not have authorization and CSRF checks when importing settings. Furthermore it also lacks proper checks to only update options relevant to the Order Delivery Date WordPress plugin before 12.3.1. This leads to attackers being able to modify the default_user_role to administrator and users_can_register, allowing them to register as an administrator of the site for complete site takeover.CVE-2025-2929tychesoftwaresorder_delivery_date_for_woocommerce+2EPSS score0.27%
The Order Delivery Date WordPress plugin before 12.4.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as adminCVE-2025-2942tychesoftwaresorder_delivery_date_for_woocommerce+2EPSS score0.30%
The Order Delivery Date WordPress plugin before 12.6.0 discloses arbitrary post title (such as from draft and private posts) via an unauthenticated AJAX action, allowing attackers to retrieve such informationCVE-2025-13835tychesoftwaresarconix_shortcodes+1EPSS score0.16%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allows Stored XSS.This issue affects Arconix Shortcodes: from n/a through <= 2.1.20.CVE-2025-13773tychesoftwaresprint_invoice_\&_delivery_notes_for_woocommerce+1EPSS score3.71%
The Print Invoice & Delivery Notes for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 5.8.0 via the 'WooCommerce_Delivery_Notes::update' function. This is due to missing capability check in the 'WooCommerce_Delivery_Notes::update' function, PHP enabled in Dompdf, and missing escape in the 'template.php' file. This makes it possible for unauthenticated attackers to execute code on the server.CVE-2025-47673tychesoftwaresarconix_shortcodes+1EPSS score0.23%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allows Reflected XSS.This issue affects Arconix Shortcodes: from n/a through <= 2.1.16.CVE-2025-66085tychesoftwaresarconix_shortcodes+1EPSS score0.19%
Missing Authorization vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Arconix Shortcodes: from n/a through <= 2.1.18.CVE-2025-66071tychesoftwarescustom_order_numbers_for_woocommerce+1EPSS score0.30%
Missing Authorization vulnerability in tychesoftwares Custom Order Numbers for WooCommerce custom-order-numbers-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Order Numbers for WooCommerce: from n/a through <= 1.11.0.CVE-2025-58599tychesoftwaresorder_delivery_date_for_woocommerce+1EPSS score0.24%
Missing Authorization vulnerability in tychesoftwares Order Delivery Date for WooCommerce order-delivery-date-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Delivery Date for WooCommerce: from n/a through <= 4.1.0.CVE-2025-69027tychesoftwaresproduct delivery date for woocommerce – lite+1EPSS score0.21%
Missing Authorization vulnerability in tychesoftwares Product Delivery Date for WooCommerce – Lite product-delivery-date-for-woocommerce-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Delivery Date for WooCommerce – Lite: from n/a through <= 3.2.0.CVE-2025-24621tychesoftwaresarconix_shortcodes+1EPSS score0.29%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allows Reflected XSS.This issue affects Arconix Shortcodes: from n/a through <= 2.1.15.CVE-2025-49874tychesoftwaresarconix_faq+1EPSS score0.23%
Missing Authorization vulnerability in tychesoftwares Arconix FAQ arconix-faq allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Arconix FAQ: from n/a through <= 1.9.6.CVE-2025-49239tychesoftwaresprint_invoice_\&_delivery_notes_for_woocommerce+1EPSS score0.15%
Cross-Site Request Forgery (CSRF) vulnerability in tychesoftwares Print Invoice & Delivery Notes for WooCommerce woocommerce-delivery-notes allows Cross Site Request Forgery.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through <= 5.5.0.CVE-2025-49858tychesoftwaresarconix_shortcodes+1EPSS score0.19%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allows Stored XSS.This issue affects Arconix Shortcodes: from n/a through <= 2.1.17.CVE-2025-32531tychesoftwaresarconix_faq+1EPSS score0.29%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tychesoftwares Arconix FAQ arconix-faq allows Reflected XSS.This issue affects Arconix FAQ: from n/a through <= 1.9.5.CVE-2020-36696tychesoftwaresproduct_input_fields_for_woocommerce+1EPSS score1.08%
The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the handle_downloads() function in versions up to, and including, 1.2.6. This makes it possible for unauthenticated attackers to download files from the vulnerable service.CVE-2022-46795tyche softwaresprint invoice & delivery notes for woocommerce+2EPSS score0.60%
Missing Authorization vulnerability in Tyche Softwares Print Invoice & Delivery Notes for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through 4.7.2.CVE-2022-45367tyche softwarescustom order numbers for woocommerce+2EPSS score0.26%
Cross-Site Request Forgery (CSRF) vulnerability in Tyche Softwares Custom Order Numbers for WooCommerce plugin <= 1.4.0 versions.