Wpdesk
Monthly
Unauthenticated sensitive data exposure in the WordPress plugin Flexible Chat 1.1.0 and earlier allows network-reachable attackers to retrieve information the plugin should not expose, with a CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The affected footprint is limited to WordPress sites running the wpdesk plugin at or below version 1.1.0; the available sources do not specify the endpoint, parameter, or exact data returned, and no public exploit was identified at time of analysis. The priority signals are modest and internally consistent, so this should not be treated as an emergency despite the High base score.
Unauthenticated local file inclusion in ShopMagic for WooCommerce (all versions up to and including 4.9.0) allows remote attackers to include and execute arbitrary .php files on a WordPress server by submitting a path payload as the billing first name during WooCommerce guest checkout. The value reaches the plugin's PHP template renderer through the {{ customer.first_name }} placeholder, and the built-in "New Order email with social media profile links" recipe processes that placeholder out of the box, so default configurations are exploitable with no account, cookie, or nonce. CVSS is 8.1 (C:H/I:H/A:H, AC:H); full code execution additionally requires that an attacker-controllable .php file already exist on the server, and no public exploit code was identified at time of analysis. The vendor-released fix is 4.9.1.
Unauthenticated PHP object injection in the WP Desk Flexible Subscriptions WordPress plugin (versions <= 1.8.1) lets remote attackers submit crafted serialized data that the plugin deserializes, enabling exploitation of PHP object magic methods. Reported by Patchstack and rated CVSS 9.8, the flaw can escalate to remote code execution, data theft, or site takeover when a suitable POP gadget chain is present in the plugin, WordPress core, or another installed extension. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authenticated IDOR in the WordPress plugin Flexible PDF Coupons (versions up to and including 1.14.11) lets a Contributor-level account manipulate object identifiers to act on coupon and PDF records it does not own. The vulnerability is network-reachable and low complexity, but requires a valid low-privilege WordPress account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, base 5.4), and per the assessed vector the impact is limited to low integrity and availability effects with no confidentiality disclosure. No public exploit identified at time of analysis; there is no CISA KEV listing and no EPSS signal was provided, and no vendor-released patch version was identified in the available data.
Broken access control in the Flexible Quantity - Measurement Price Calculator for WooCommerce plugin (WPDesk) version 2.3.21 and earlier allows unauthenticated network attackers to perform restricted actions due to missing server-side authorization checks. The vulnerability (CWE-862) results in low-severity integrity impact - likely unauthorized manipulation of quantity or pricing-related plugin functionality - without requiring credentials or user interaction. No public exploit code or active exploitation has been identified at time of analysis, and Patchstack reported this as a standard missing-authorization class issue with a CVSS base score of 5.3.
Broken access control in the Autopay dla WooCommerce WordPress plugin (versions <= 2.2.27) permits unauthenticated remote attackers to invoke restricted plugin functionality without authorization. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials and no user interaction against any default-configured WordPress site running the affected plugin. The resulting impact spans limited integrity and availability degradation - consistent with unauthorized manipulation of payment or order-related plugin endpoints - with no public exploit identified at time of analysis and no CISA KEV listing.
Stored cross-site scripting in the wpdesk Flexible Refund and Return Order for WooCommerce plugin (versions through 1.0.51) allows authenticated low-privileged users - such as registered WooCommerce customers - to inject persistent malicious scripts that execute in the browsers of other users, including administrators who review refund submissions. The scope-changed CVSS vector (S:C) confirms impact crosses security boundaries, enabling session hijacking, credential theft, or unauthorized administrative actions against shop owners. No public exploit code has been identified at time of analysis, and this vulnerability has not been listed in the CISA KEV catalog.
The Flexible Wishlist for WooCommerce - Ecommerce Wishlist & Save for later plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.26. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
Missing Authorization vulnerability in WP Desk Flexible Checkout Fields for WooCommerce.1.2. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Flexible Checkout Fields for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Arbitrary Plugin Settings update, in addition to Stored Cross-Site Scripting in versions up to, and. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 19.5%.
Unauthenticated sensitive data exposure in the WordPress plugin Flexible Chat 1.1.0 and earlier allows network-reachable attackers to retrieve information the plugin should not expose, with a CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The affected footprint is limited to WordPress sites running the wpdesk plugin at or below version 1.1.0; the available sources do not specify the endpoint, parameter, or exact data returned, and no public exploit was identified at time of analysis. The priority signals are modest and internally consistent, so this should not be treated as an emergency despite the High base score.
Unauthenticated local file inclusion in ShopMagic for WooCommerce (all versions up to and including 4.9.0) allows remote attackers to include and execute arbitrary .php files on a WordPress server by submitting a path payload as the billing first name during WooCommerce guest checkout. The value reaches the plugin's PHP template renderer through the {{ customer.first_name }} placeholder, and the built-in "New Order email with social media profile links" recipe processes that placeholder out of the box, so default configurations are exploitable with no account, cookie, or nonce. CVSS is 8.1 (C:H/I:H/A:H, AC:H); full code execution additionally requires that an attacker-controllable .php file already exist on the server, and no public exploit code was identified at time of analysis. The vendor-released fix is 4.9.1.
Unauthenticated PHP object injection in the WP Desk Flexible Subscriptions WordPress plugin (versions <= 1.8.1) lets remote attackers submit crafted serialized data that the plugin deserializes, enabling exploitation of PHP object magic methods. Reported by Patchstack and rated CVSS 9.8, the flaw can escalate to remote code execution, data theft, or site takeover when a suitable POP gadget chain is present in the plugin, WordPress core, or another installed extension. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authenticated IDOR in the WordPress plugin Flexible PDF Coupons (versions up to and including 1.14.11) lets a Contributor-level account manipulate object identifiers to act on coupon and PDF records it does not own. The vulnerability is network-reachable and low complexity, but requires a valid low-privilege WordPress account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, base 5.4), and per the assessed vector the impact is limited to low integrity and availability effects with no confidentiality disclosure. No public exploit identified at time of analysis; there is no CISA KEV listing and no EPSS signal was provided, and no vendor-released patch version was identified in the available data.
Broken access control in the Flexible Quantity - Measurement Price Calculator for WooCommerce plugin (WPDesk) version 2.3.21 and earlier allows unauthenticated network attackers to perform restricted actions due to missing server-side authorization checks. The vulnerability (CWE-862) results in low-severity integrity impact - likely unauthorized manipulation of quantity or pricing-related plugin functionality - without requiring credentials or user interaction. No public exploit code or active exploitation has been identified at time of analysis, and Patchstack reported this as a standard missing-authorization class issue with a CVSS base score of 5.3.
Broken access control in the Autopay dla WooCommerce WordPress plugin (versions <= 2.2.27) permits unauthenticated remote attackers to invoke restricted plugin functionality without authorization. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials and no user interaction against any default-configured WordPress site running the affected plugin. The resulting impact spans limited integrity and availability degradation - consistent with unauthorized manipulation of payment or order-related plugin endpoints - with no public exploit identified at time of analysis and no CISA KEV listing.
Stored cross-site scripting in the wpdesk Flexible Refund and Return Order for WooCommerce plugin (versions through 1.0.51) allows authenticated low-privileged users - such as registered WooCommerce customers - to inject persistent malicious scripts that execute in the browsers of other users, including administrators who review refund submissions. The scope-changed CVSS vector (S:C) confirms impact crosses security boundaries, enabling session hijacking, credential theft, or unauthorized administrative actions against shop owners. No public exploit code has been identified at time of analysis, and this vulnerability has not been listed in the CISA KEV catalog.
The Flexible Wishlist for WooCommerce - Ecommerce Wishlist & Save for later plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.26. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
Missing Authorization vulnerability in WP Desk Flexible Checkout Fields for WooCommerce.1.2. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Flexible Checkout Fields for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Arbitrary Plugin Settings update, in addition to Stored Cross-Site Scripting in versions up to, and. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 19.5%.