CveMateVulnerability intelligence

Wpexperts vulnerabilities, page 2

56 vulnerabilities

Known vulnerabilities in Wpexperts products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 22 products.

CVE-2024-52436saad iqbalpost smtp+21y ago18-11-2024 14:30

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal Post SMTP post-smtp allows Blind SQL Injection.This issue affects Post SMTP: from n/a through <= 2.9.9.CVE-2024-1639saadiqballicense manager for woocommerce+22y ago21-06-2024 02:05

The License Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the showLicenseKey() and showAllLicenseKeys() functions in all versions up to, and including, 3.0.6. This makes it possible for authenticated attackers, with admin dashboard access (contributors by default due to WooCommerce) to view arbitrary decrypted license keys. The functions contain a referrer nonce check. However, these can be retrieved via the dashboard through the "license" JS variable. Please note that the version in trunk is patched, however, the 3.0.7 tagged version is not.CVE-2024-0656saadiqbalpassword protected — lock entire site, pages, posts, categories, and partial content+22y ago20-02-2024 18:56

The Password Protected – Ultimate Plugin to Password Protect Your WordPress Content with Ease plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Captcha Site Key in all versions up to, and including, 2.6.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.CVE-2024-31297wordpresswoocommerce-wholesale-pricing+12y ago10-04-2024 15:58

Missing Authorization vulnerability in WPExperts Wholesale For WooCommerce.This issue affects Wholesale For WooCommerce: from n/a through 2.3.0.CVE-2024-4753unknownwp secure maintenance+22y ago12-07-2024 06:00

The WP Secure Maintenance WordPress plugin before 1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)CVE-2024-43214saad iqbalmycred+22y ago26-08-2024 20:21

Missing Authorization vulnerability in Saad Iqbal myCred mycred.This issue affects myCred: from n/a through <= 2.7.2.CVE-2024-29128post smtppost smtp+12y ago19-03-2024 14:04

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Post SMTP POST SMTP allows Reflected XSS.This issue affects POST SMTP: from n/a through 2.8.6.CVE-2024-27959wordpresswoosquare+22y ago17-03-2024 16:27

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpexpertsio WC Shop Sync – Integrate Square and WooCommerce for Seamless Shop Management allows Reflected XSS.This issue affects WC Shop Sync – Integrate Square and WooCommerce for Seamless Shop Management: from n/a through 4.2.9.CVE-2024-5207saadiqbalpost smtp – complete email deliverability and smtp solution with email logs, alerts, backup smtp & mobile app+22y ago30-05-2024 05:33

The POST SMTP – The #1 WordPress SMTP Plugin with Advanced Email Logging and Delivery Failure Notifications plugin for WordPress is vulnerable to time-based SQL Injection via the selected parameter in all versions up to, and including, 2.9.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with administrator access or higher to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.CVE-2024-30469wordpresswoocommerce-wholesale-pricing+12y ago29-03-2024 15:47

Missing Authorization vulnerability in WPExperts Wholesale For WooCommerce.This issue affects Wholesale For WooCommerce: from n/a through 2.3.0.CVE-2024-12475wordpresswp-multi-store-locator+21y ago04-01-2025 11:16

The WP Multi Store Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2019-25150saadiqbalemail templates customizer and designer for wordpress and woocommerce+23y ago07-06-2023 01:51

The Email Templates plugin for WordPress is vulnerable to HTML Injection in versions up to, and including, 1.3. This makes it possible for attackers to present phishing forms or conduct cross-site request forgery attacks against site administrators.CVE-2026-62058wordpresscontact-form-7-honeypot+120d ago01-10-2026 12:40

Insertion of Sensitive Information Into Sent Data vulnerability in WPExperts CF7 Apps contact-form-7-honeypot allows Retrieve Embedded Sensitive Data.This issue affects CF7 Apps: from n/a through 3.7.2.CVE-2026-48838wordpresspost-smtp+14mo ago15-06-2026 20:18

Unauthenticated Cross Site Scripting (XSS) in Post SMTP <= 3.6.2 versions.CVE-2026-81278wordpresspost-smtp+11mo ago31-08-2026 20:40

Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post SMTP: from 4.0.0 through beta.1.CVE-2026-32466wordpressgf-bookings-premium+12mo ago18-08-2026 13:59

Subscriber SQL Injection in Gravity Forms Bookings premium <= 2.1 versions.CVE-2023-52233post smtppost smtp mailer/email log+12y ago11-06-2024 16:05

Missing Authorization vulnerability in Post SMTP Post SMTP Mailer/Email Log.This issue affects Post SMTP Mailer/Email Log: from n/a through 2.8.6.CVE-2023-47853mycredmycred – points, rewards, gamification, ranks, badges & loyalty plugin+22y ago30-11-2023 16:49

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in myCred myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin allows Stored XSS.This issue affects myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin: from n/a through 2.6.1.CVE-2023-48742licensemanagerlicense manager for woocommerce+22y ago30-11-2023 14:07

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LicenseManager License Manager for WooCommerce license-manager-for-woocommerce allows SQL Injection.This issue affects License Manager for WooCommerce: from n/a through 2.2.10.CVE-2023-0152unknownwp multi store locator+23y ago05-06-2023 13:39

The WP Multi Store Locator WordPress plugin through 2.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks