Wpexperts.Io vulnerabilities
12 vulnerabilities
Known vulnerabilities in Wpexperts.Io products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 9 products.
Products
8 of 9- WP Multistore Locator4 vulnerabilities
- Apiexperts Square For Woocommerce1 vulnerabilities
- Email Templates Customizer And Designer For Wordpress And Woocommerce1 vulnerabilities
- New User Approve1 vulnerabilities
- Rocket Maintenance Mode & Coming Soon Page1 vulnerabilities
- WC Shop Sync – Integrate Square And Woocommerce For Seamless Shop Management1 vulnerabilities
- WP Multi Store Locator Pro1 vulnerabilities
- WP PDF Generator1 vulnerabilities
CVE-2025-26974wordpresswp-multi-store-locator+1
EPSS score0.53%
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPExperts.io WP Multistore Locator wp-multi-store-locator allows Blind SQL Injection.This issue affects WP Multistore Locator: from n/a through <= 2.5.1.CVE-2025-31888wordpresswp-multi-store-locator+1EPSS score0.15%
Cross-Site Request Forgery (CSRF) vulnerability in WPExperts.io WP Multistore Locator wp-multi-store-locator allows Cross Site Request Forgery.This issue affects WP Multistore Locator: from n/a through <= 2.5.2.CVE-2025-24680wordpresswp-multi-store-locator+2EPSS score0.26%
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WPExperts.io WP Multistore Locator wp-multi-store-locator allows Reflected XSS.This issue affects WP Multistore Locator: from n/a through <= 2.4.7.CVE-2025-28898wordpresswp-multi-store-locator+1EPSS score0.60%
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPExperts.io WP Multistore Locator wp-multi-store-locator allows SQL Injection.This issue affects WP Multistore Locator: from n/a through <= 2.5.2.CVE-2022-47181wordpressemail-templates+2EPSS score0.28%
Cross-Site Request Forgery (CSRF) vulnerability in wpexpertsio Email Templates Customizer and Designer for WordPress and WooCommerce email-templates allows Cross Site Request Forgery.This issue affects Email Templates Customizer and Designer for WordPress and WooCommerce: from n/a through 1.4.2.CVE-2022-47182wordpresswoosquare+1EPSS score0.53%
Missing Authorization vulnerability in Wpexpertsio APIExperts Square for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for WooCommerce: from n/a through 4.4.1.CVE-2024-27959wordpresswoosquare+2EPSS score0.37%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpexpertsio WC Shop Sync – Integrate Square and WooCommerce for Seamless Shop Management allows Reflected XSS.This issue affects WC Shop Sync – Integrate Square and WooCommerce for Seamless Shop Management: from n/a through 4.2.9.CVE-2024-12475wordpresswp-multi-store-locator+2EPSS score0.32%
The WP Multi Store Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2026-15275wordpresswp-multi-store-locator-pro+1EPSS score0.37%
The WP Multi Store Locator Pro plugin for WordPress is vulnerable to generic SQL Injection via the 'store_locatore_search_radius' parameter in all versions up to, and including, 4.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injection occurs in a numeric, unquoted SQL context, meaning WordPress's wp_magic_quotes() addslashes-based protection cannot neutralize the payload, and the AJAX handler is registered on wp_ajax_nopriv_make_search_request with no nonce or capability check, making it fully accessible without authentication.CVE-2023-49842wordpressrocket-maintenance-mode+2EPSS score0.39%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpexpertsio Rocket Maintenance Mode & Coming Soon Page allows Stored XSS.This issue affects Rocket Maintenance Mode & Coming Soon Page: from n/a through 4.3.CVE-2023-50902wordpressnew-user-approve+2EPSS score0.23%
Cross-Site Request Forgery (CSRF) vulnerability in WPExpertsio New User Approve.This issue affects New User Approve: from n/a through 2.5.1.CVE-2023-35038wordpresswp-pdf-generator+2EPSS score0.25%
Cross-Site Request Forgery (CSRF) vulnerability in wpexperts.Io WP PDF Generator plugin <= 1.2.2 versions.