Wpclever
33 CVEs across 24 Wpclever products. Browse Wpclever vulnerabilities, severities, and proof-of-concept exploits.
Wpclever products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-7436 | Medium | 6.4 | 2026-07-29 | The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the `wpcbm_best_seller`… |
CVE-2026-49061 | High | 7.5 | 2026-06-15 | Unauthenticated Arbitrary File Download in WPC Product Options for WooCommerce <= 3.2.1 versions. |
CVE-2026-48883 | High | 7.5 | 2026-06-15 | Unauthenticated Broken Access Control in WPC Product Bundles for WooCommerce <= 8.5.3 versions. |
CVE-2025-14767 | Medium | 5.5 | 2026-05-13 | The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the `wpcbm_best_seller`… |
CVE-2026-6725 | Medium | 6.4 | 2026-04-28 | The WPC Smart Messages for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the `wpcsm_text_rotator` s… |
CVE-2026-32407 | Medium | 4.3 | 2026-03-13 | Missing Authorization vulnerability in WPClever WPC Smart Wishlist for WooCommerce woo-smart-wishlist allows Exploiting Incorrectly Configured Access Control S… |
CVE-2026-32406 | Medium | 4.3 | 2026-03-13 | Missing Authorization vulnerability in WPClever WPC Product Bundles for WooCommerce woo-product-bundle allows Exploiting Incorrectly Configured Access Control… |
CVE-2025-60248 | High | 7.5 | 2025-11-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WPClever WPC Product Options for WooCo… |
CVE-2025-12115 | High | 7.5 | 2025-10-31 | The WPC Name Your Price for WooCommerce plugin for WordPress is vulnerable to unauthorized price alteration in all versions up to, and including, 2.1.9. This i… |
CVE-2025-62903 | Medium | 6.5 | 2025-10-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPClever WPC Smart Messages for WooCommerce wpc-smart-mes… |
CVE-2025-49908 | Medium | 6.5 | 2025-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPClever WPC Countdown Timer for WooCommerce wpc-countdow… |
CVE-2025-11741 | Medium | 5.3 | 2025-10-18 | The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.2.5 via the 'woosq_… |
CVE-2025-11742 | Medium | 4.3 | 2025-10-18 | The WPC Smart Wishlist for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'wishlist_qui… |
CVE-2025-11518 | Medium | 5.3 | 2025-10-11 | The WPC Smart Wishlist for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.0.3 via s… |
CVE-2025-8618 | Medium | 6.4 | 2025-08-20 | The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's woosq_btn shortcode in all versions… |
CVE-2025-7496 | Medium | 6.4 | 2025-08-19 | The WPC Smart Compare for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via DOM elements in all versions up to, and including… |
CVE-2025-5530 | Medium | 6.4 | 2025-07-11 | The WPC Smart Compare for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shortcode_btn' shortcode in all versi… |
CVE-2025-3418 | High | 8.8 | 2025-04-12 | The WPC Admin Columns plugin for WordPress is vulnerable to privilege escalation in versions 2.0.6 to 2.1.0. This is due to the plugin not properly restricting… |
CVE-2025-30825 | High | 8.8 | 2025-04-01 | Missing Authorization vulnerability in WPClever WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce wpc-smart-linked-products allows Privilege Es… |
CVE-2025-30772 | High | 8.8 | 2025-03-27 | Missing Authorization vulnerability in WPClever WPC Smart Upsell Funnel for WooCommerce wpc-smart-upsell-funnel allows Privilege Escalation.This issue affects… |
CVE-2024-12432 | High | 8.1 | 2024-12-18 | The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to account takeover and privilege escalation in all versions up to, and including… |
CVE-2024-12004 | Medium | 6.1 | 2024-12-11 | The WPC Order Notes for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.2. This is due t… |
CVE-2024-5020 | Medium | 6.4 | 2024-12-04 | Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions 1.3.4 to 3.5.7) in… |
CVE-2024-43312 | Medium | 5.4 | 2024-11-01 | Missing Authorization vulnerability in WPClever WPC Frequently Bought Together for WooCommerce allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2024-10437 | Medium | 4.3 | 2024-10-29 | The WPC Smart Messages for WooCommerce plugin for WordPress is vulnerable to unauthorized Smar Message activation/deactivation due to a missing capability chec… |
CVE-2024-10436 | High | 8.8 | 2024-10-29 | The WPC Smart Messages for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.2.1 via the get_condi… |
CVE-2024-50416 | High | 8.8 | 2024-10-28 | Deserialization of Untrusted Data vulnerability in WPClever WPC Shop as a Customer for WooCommerce wpc-shop-as-customer allows Object Injection.This issue affe… |
CVE-2024-30537 | Medium | 4.3 | 2024-06-09 | Missing Authorization vulnerability in WPClever WPC Badge Management for WooCommerce.This issue affects WPC Badge Management for WooCommerce: from n/a through… |
CVE-2024-2838 | Medium | 6.4 | 2024-04-27 | The WPC Composite Products for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wooco_components[0][name]' parameter in a… |
CVE-2024-32687 | Medium | 4.3 | 2024-04-22 | Missing Authorization vulnerability in WPClever WPC Frequently Bought Together for WooCommerce.This issue affects WPC Frequently Bought Together for WooCommerc… |
CVE-2024-32520 | Medium | 4.3 | 2024-04-17 | Missing Authorization vulnerability in WPClever WPC Grouped Product for WooCommerce.This issue affects WPC Grouped Product for WooCommerce: from n/a through 4… |
CVE-2023-6494 | Medium | 4.4 | 2024-04-13 | The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and includ… |
CVE-2023-52127 | Medium | 4.3 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in WPClever WPC Product Bundles for WooCommerce.This issue affects WPC Product Bundles for WooCommerce: from n/… |
CVE-2023-34386 | Medium | 4.3 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in WPClever WPC Smart Wishlist for WooCommerce plugin <= 4.7.1 versions. |
CVE-2022-1465 | Medium | 6.1 | 2022-05-16 | The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.9 does not sanitise and escape a parameter before outputting it back in an attribute via an… |
CVE-2022-0397 | Medium | 5.4 | 2022-03-28 | The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.4 does not sanitise and escape the key parameter before outputting it back in the wishlist_q… |