Vanquish
21 CVEs across 12 Vanquish products. Browse Vanquish vulnerabilities, severities, and proof-of-concept exploits.
Vanquish products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-32522 | High | 8.6 | 2026-03-25 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanquish WooCommerce Support Ticket System woocommerce-support-… |
CVE-2026-27374 | High | 7.5 | 2026-03-05 | Missing Authorization vulnerability in vanquish WooCommerce Order Details woocommerce-order-details allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2025-69381 | High | 7.1 | 2026-02-20 | Missing Authorization vulnerability in vanquish WooCommerce Bulk Product Editor woocommerce-quick-product-editor allows Exploiting Incorrectly Configured Acces… |
CVE-2025-69380 | High | 7.5 | 2026-02-20 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanquish Upload Files Anywhere wp-upload-files-anywhere allows… |
CVE-2025-69379 | High | 8.6 | 2026-02-20 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanquish Upload Files Anywhere wp-upload-files-anywhere allows… |
CVE-2025-69377 | High | 7.7 | 2026-02-20 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Path Tra… |
CVE-2025-69376 | High | 8.6 | 2026-02-20 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Path Tra… |
CVE-2025-67991 | High | 7.1 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Re… |
CVE-2025-22713 | High | 8.5 | 2026-01-08 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in vanquish WooCommerce Orders & Customers Exporter woocomme… |
CVE-2025-67579 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-7846 | High | 8.8 | 2025-10-31 | The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the save_fields() fun… |
CVE-2025-53424 | Medium | 6.5 | 2025-10-22 | Missing Authorization vulnerability in vanquish WooCommerce Orders & Customers Exporter woocommerce-orders-ei allows Exploiting Incorrectly Configured Access C… |
CVE-2025-48331 | High | 7.5 | 2025-05-30 | Insertion of Sensitive Information Into Sent Data vulnerability in vanquish WooCommerce Orders & Customers Exporter woocommerce-orders-customers-exporter allow… |
CVE-2024-13775 | Medium | 5.4 | 2025-02-01 | The WooCommerce Support Ticket System plugin for WordPress is vulnerable to unauthorized access and loss of data due to missing capability checks on the 'ajax_… |
CVE-2024-13343 | High | 8.8 | 2025-02-01 | The WooCommerce Customers Manager plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the ajax_assign_new_roles() f… |
CVE-2024-11150 | Critical | 9.8 | 2024-11-13 | The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_tmp_upload… |
CVE-2024-10800 | High | 8.8 | 2024-11-13 | The WordPress User Extra Fields plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the ajax_save_fields() function… |
CVE-2024-10820 | Critical | 9.8 | 2024-11-13 | The WooCommerce Upload Files plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload_files() function in… |
CVE-2024-10801 | Critical | 9.8 | 2024-11-09 | The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_manage_file_chunk_… |
CVE-2024-10627 | Critical | 9.8 | 2024-11-09 | The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_manage_file_… |
CVE-2024-10626 | High | 8.8 | 2024-11-09 | The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_uplo… |
CVE-2024-10625 | Critical | 9.8 | 2024-11-09 | The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_tmp_… |
CVE-2024-3983 | High | 8.1 | 2024-08-01 | The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in ad… |
CVE-2024-2843 | Medium | 6.5 | 2024-08-01 | The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some places, which could allow attackers to make logged in admin us… |
CVE-2024-1747 | Medium | 6.5 | 2024-08-01 | The WooCommerce Customers Manager WordPress plugin before 30.2 does not have authorisation and CSRF in various AJAX actions, allowing any authenticated users… |
CVE-2024-1756 | Medium | 6.5 | 2024-04-24 | The WooCommerce Customers Manager WordPress plugin before 29.8 does not have authorisation and CSRF in an AJAX action, allowing any authenticated users, such a… |
CVE-2024-1743 | Medium | 5.9 | 2024-04-24 | The WooCommerce Customers Manager WordPress plugin before 29.8 does not sanitise and escape various parameters before outputting them back in pages and attribu… |
CVE-2024-0399 | High | 8.1 | 2024-04-15 | The WooCommerce Customers Manager WordPress plugin before 29.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to… |
CVE-2021-24171 | Critical | 9.8 | 2021-04-05 | The WooCommerce Upload Files WordPress plugin before 59.4 ran a single sanitization pass to remove blocked extensions such as .php. It was possible to bypass t… |