CveMateVulnerability intelligence

Wpclever vulnerabilities

41 vulnerabilities

Known vulnerabilities in Wpclever products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 18 products.

Products

18

Wpc Smart Wishlist For Woocommerce6 vulnerabilities
Wpc Smart Quick View For Woocommerce5 vulnerabilities
Wpc Product Bundles For Woocommerce4 vulnerabilities
WPC Smart Messages For Woocommerce4 vulnerabilities
Wpc Badge Management For Woocommerce3 vulnerabilities
WPC Product Options For Woocommerce3 vulnerabilities
Wpc Shop As A Customer For Woocommerce3 vulnerabilities
Wpc Frequently Bought Together For Woocommerce2 vulnerabilities
Wpc Smart Compare For Woocommerce2 vulnerabilities
WPC Admin Columns1 vulnerabilities
WPC Composite Products For Woocommerce1 vulnerabilities
WPC Countdown Timer For Woocommerce1 vulnerabilities
WPC Estimated Delivery Date For Woocommerce1 vulnerabilities
WPC Grouped Product For Woocommerce1 vulnerabilities
WPC Name Your Price For Woocommerce1 vulnerabilities
WPC Order Notes For Woocommerce1 vulnerabilities
WPC Smart Linked Products Upsells & Cross Sells For Woocommerce1 vulnerabilities
WPC Smart Upsell Funnel For Woocommerce1 vulnerabilities

CVE-2025-62903wordpresswpc-smart-messages+111mo ago27-10-2025 01:33

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPClever WPC Smart Messages for WooCommerce wpc-smart-messages allows Stored XSS.This issue affects WPC Smart Messages for WooCommerce: from n/a through <= 4.2.8.CVE-2025-11742wordpresswoo-smart-wishlist+11y ago18-10-2025 05:41

The WPC Smart Wishlist for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'wishlist_quickview' AJAX action in all versions up to, and including, 5.0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view other user's wishlist data and information.CVE-2025-11741wordpresswoo-smart-quick-view+11y ago18-10-2025 06:42

The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.2.5 via the 'woosq_quickview' AJAX endpoint due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft products that they should not have access to.CVE-2025-11518wordpresswoo-smart-wishlist+11y ago11-10-2025 08:29

The WPC Smart Wishlist for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.0.3 via several wishlist AJAX functions due to missing validation on a user controlled key that is exposed when wishlists are shared. This makes it possible for unauthenticated attackers to empty and add to other user's wishlists, if they have access to the key.CVE-2025-14767wordpresswpc-badge-management+15mo ago13-05-2026 07:44

The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the `wpcbm_best_seller` shortcode in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2025-7496wordpresswoo-smart-compare+11y ago19-08-2025 03:39

The WPC Smart Compare for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via DOM elements in all versions up to, and including, 6.4.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2025-5530wordpresswoo-smart-compare+11y ago11-07-2025 07:23

The WPC Smart Compare for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shortcode_btn' shortcode in all versions up to, and including, 6.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2025-49908wordpresswpc-countdown-timer+112mo ago22-10-2025 14:32

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPClever WPC Countdown Timer for WooCommerce wpc-countdown-timer allows Stored XSS.This issue affects WPC Countdown Timer for WooCommerce: from n/a through <= 3.1.4.CVE-2025-30825wordpresswpc-smart-linked-products+11y ago01-04-2025 20:58

Missing Authorization vulnerability in WPClever WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce wpc-smart-linked-products allows Privilege Escalation.This issue affects WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce: from n/a through <= 1.3.5.CVE-2025-30772wordpresswpc-smart-upsell-funnel+11y ago27-03-2025 10:54

Missing Authorization vulnerability in WPClever WPC Smart Upsell Funnel for WooCommerce wpc-smart-upsell-funnel allows Privilege Escalation.This issue affects WPC Smart Upsell Funnel for WooCommerce: from n/a through <= 3.0.4.CVE-2025-12115wordpresswpc-name-your-price+111mo ago31-10-2025 09:27

The WPC Name Your Price for WooCommerce plugin for WordPress is vulnerable to unauthorized price alteration in all versions up to, and including, 2.1.9. This is due to the plugin not disabling the ability to name a custom price when it has been specifically disabled for a product. This makes it possible for unauthenticated attackers to purchase products at prices less than they should be able to.CVE-2025-8618wordpresswoo-smart-quick-view+11y ago20-08-2025 04:26

The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's woosq_btn shortcode in all versions up to, and including, 4.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2025-3418wordpresswpc-admin-columns+11y ago12-04-2025 06:37

The WPC Admin Columns plugin for WordPress is vulnerable to privilege escalation in versions 2.0.6 to 2.1.0. This is due to the plugin not properly restricting user meta values that can be updated through the ajax_edit_save() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update their role to that of an administrator.CVE-2025-60248wordpresswpc-product-options+111mo ago06-11-2025 15:55

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WPClever WPC Product Options for WooCommerce wpc-product-options allows PHP Local File Inclusion.This issue affects WPC Product Options for WooCommerce: from n/a through <= 3.1.3.CVE-2022-1465unknownwpc smart wishlist for woocommerce+24y ago16-05-2022 14:31

The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.9 does not sanitise and escape a parameter before outputting it back in an attribute via an AJAX action, leading to a Reflected Cross-Site Scripting issue.CVE-2022-0397unknownwpc smart wishlist for woocommerce+24y ago28-03-2022 17:22

The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.4 does not sanitise and escape the key parameter before outputting it back in the wishlist_quickview AJAX action's response (available to any authenticated user), leading to a Reflected Cross-Site Scripting CVE-2024-2838wordpresswpc-composite-products+12y ago27-04-2024 03:33

The WPC Composite Products for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wooco_components[0][name]' parameter in all versions up to, and including, 7.2.7 due to insufficient input sanitization and output escaping and missing authorization on the ajax_save_components function. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2024-43312wordpresswoo-bought-together+11y ago01-11-2024 14:17

Missing Authorization vulnerability in WPClever WPC Frequently Bought Together for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPC Frequently Bought Together for WooCommerce: from n/a through 7.1.9.CVE-2024-502010webform maker by 10web – mobile-friendly drag & drop contact form builder+301y ago04-12-2024 08:22

Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions 1.3.4 to 3.5.7) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2024-10436wordpresswpc-smart-messages+11y ago29-10-2024 09:31

The WPC Smart Messages for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.2.1 via the get_condition_value function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.