Storeapps
10 CVEs across 11 Storeapps products. Browse Storeapps vulnerabilities, severities, and proof-of-concept exploits.
Storeapps products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-57704 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Scripting (XSS) in Smart Manager <= 8.90.0 versions. |
CVE-2026-45216 | High | 8.8 | 2026-05-25 | Incorrect Privilege Assignment vulnerability in StoreApps Smart Manager allows Privilege Escalation. This issue affects Smart Manager: from n/a through 8.85.0. |
CVE-2026-24365 | Medium | 5.4 | 2026-01-22 | Cross-Site Request Forgery (CSRF) vulnerability in storeapps Stock Manager for WooCommerce woocommerce-stock-manager allows Cross Site Request Forgery.This iss… |
CVE-2025-22710 | High | 7.6 | 2025-01-21 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in storeapps Smart Manager smart-manager-for-wp-e-commerce a… |
CVE-2024-49687 | Medium | 4.3 | 2024-12-31 | Missing Authorization vulnerability in storeapps Smart Manager smart-manager-for-wp-e-commerce.This issue affects Smart Manager: from n/a through <= 8.45.0. |
CVE-2023-5663 | High | 8.8 | 2024-03-13 | The News Announcement Scroll plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 9.0.0 due to insu… |
CVE-2024-0566 | High | 7.2 | 2024-02-12 | The Smart Manager WordPress plugin before 8.28.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injecti… |
CVE-2023-35091 | Medium | 4.3 | 2023-07-11 | Cross-Site Request Forgery (CSRF) vulnerability in StoreApps Stock Manager for WooCommerce plugin <= 2.10.0 versions. |
CVE-2022-40694 | Medium | 4.8 | 2022-11-17 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in News Announcement Scroll plugin <= 8.8.8 on WordPress. |
CVE-2022-36284 | Medium | 6.4 | 2022-08-05 | Authenticated IDOR vulnerability in StoreApps Affiliate For WooCommerce premium plugin <= 4.7.0 at WordPress allows an attacker to change the PayPal email. Woo… |
CVE-2022-25649 | Medium | 5.0 | 2022-08-05 | Multiple Improper Access Control vulnerabilities in StoreApps Affiliate For WooCommerce premium plugin <= 4.7.0 at WordPress. |
CVE-2021-24836 | Medium | 4.3 | 2021-12-13 | The Temporary Login Without Password WordPress plugin before 1.7.1 does not have authorisation and CSRF checks when updating its settings, which could allows a… |
CVE-2021-34619 | High | 8.8 | 2021-07-21 | The WooCommerce Stock Manager WordPress plugin is vulnerable to Cross-Site Request Forgery leading to Arbitrary File Upload in versions up to, and including, 2… |