47
CVEs
3
Critical
14
High
0
KEV
4
PoC
17
Unpatched C/H
8.5%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
3
HIGH
14
MEDIUM
28
LOW
2
Monthly CVE Trend
Affected Products (30)
Wordpress Plugin
39
Woocommerce
11
Photo Reviews For Woocommerce
5
Curcy
3
Abandoned Cart Recovery For Woocommerce
3
Ald Dropshipping And Fulfillment For Aliexpress And Woocommerce
2
Buildkit Product Builder For Woocommerce Custom Pc Builder
2
Thank You Page Customizer For Woocommerce
2
Gift4U
2
Bopo Woocommerce Product Bundle Builder
2
Wpbulky
2
Woocommerce Thank You Page Customizer
2
Affi Affiliate Marketing For Woocommerce
2
Tmds
1
PHP
1
Suggestion Engine For Woocommerce
1
S2W Import Shopify To Woocommerce
1
W2S
1
Orders Tracking For Woocommerce
1
Customer Coupons For Woocommerce
1
Dropshipping And Fulfillment For Aliexpress And Woocommerce
1
Product Variations Swatches For Woocommerce
1
Product Size Chart For Woocommerce
1
Curcy Multi Currency For Woocommerce Smoothly On Woocommerce 9 X
1
Woocommerce Email Template Customizer
1
Happy
1
Salevo
1
Lookzy
1
Woocommerce Multi Currency
1
Exmage
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2022-1037 | The EXMAGE WordPress plugin before 1.0.7 does to ensure that images added via URLs are external images, which could lead to a blind SSRF issue by using local URLs. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.2 | 1.3% | 56 |
PoC
No patch
|
| CVE-2023-50831 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme CURCY - Multi Currency for WooCommerce allows Stored XSS.2.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 6.5 | 0.2% | 53 |
PoC
No patch
|
| CVE-2021-4379 | The WooCommerce Multi Currency plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wmc_bulk_fixed_price function in versions up to, and including,. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 6.5 | 0.1% | 53 |
PoC
No patch
|
| CVE-2026-104398 | Unauthenticated PHP Object Injection in the AFFI - Affiliate Marketing for WooCommerce WordPress plugin (all versions through 1.0.10) allows remote attackers to pass crafted serialized data to PHP unserialize(), enabling arbitrary object instantiation that could lead to remote code execution, file manipulation, or data theft if a viable POP gadget chain exists in the plugin, WordPress core, WooCommerce, or other installed extensions. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required to reach the vulnerable code path, but the independent assessment notes that real-world severity depends heavily on the presence of a usable gadget chain, making the nominal 9.8 score more nuanced in practice. No public exploit identified at time of analysis, and no CISA KEV listing was provided in the intelligence; the sole reference is the Patchstack vulnerability database entry. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2024-8277 | The WooCommerce Photo Reviews Premium plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.3.13.2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 1.6% | 49 |
No patch
|
| CVE-2026-54809 | Blind SQL injection in the VillaTheme GIFT4U WordPress plugin (versions through 1.0.10) allows remote unauthenticated attackers to inject arbitrary SQL into backend queries via unsanitized user input. The CVSS 9.3 score reflects a scope-changed impact with high confidentiality loss and partial availability impact, though no public exploit identified at time of analysis and the flaw is not listed in CISA KEV. | CRITICAL | 9.3 | 0.2% | 47 |
No patch
|
| CVE-2026-81277 | SQL Injection in VillaTheme's Suggestion Engine for WooCommerce plugin (versions ≤ 2.0.11) enables contributor-level authenticated WordPress users to inject malicious SQL through the suggestion engine functionality. The CVSS scope-change indicator (S:C) confirms the injection can reach data beyond the plugin's own tables, exposing the broader WordPress MySQL database with high confidentiality impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, low-privilege attack profile makes this a credible threat on any WordPress/WooCommerce site that permits contributor accounts. | HIGH | 8.5 | 0.3% | 43 |
No patch
|
| CVE-2026-82227 | SQL injection in WPBulky WordPress plugin (versions ≤ 1.2.2) is exploitable by any authenticated user holding a Contributor-level role, requiring no user interaction and no special configuration beyond plugin installation. The CVSS Scope:Changed flag combined with high confidentiality impact indicates the injection can reach beyond WordPress application data into the underlying MySQL database, enabling extraction of password hashes, private content, and any other data accessible to the database user. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, low-privilege attack vector makes this a realistic threat on sites with open user registration. | HIGH | 8.5 | 0.2% | 42 |
No patch
|
| CVE-2026-102379 | Blind SQL injection in the VillaTheme BuildKit - Product Builder for WooCommerce - Custom PC Builder WordPress plugin (all versions through 1.0.28) lets an authenticated, low-privilege user on a WooCommerce site inject SQL into plugin-supplied queries and infer database contents one bit at a time. Because the injection is blind, extraction is slow but still permits disclosure of high-impact data such as WordPress user hashes, customer records, and WooCommerce order details. The flaw rates CVSS 3.1 8.5 (HIGH) with remote reachability, low attack complexity, and no user interaction, and the primary barrier is the requirement for a valid low-privileged account (PR:L). No public exploit code and no confirmed active exploitation were identified at time of analysis. | HIGH | 8.5 | 0.2% | 42 |
No patch
|
| CVE-2026-101923 | Unauthenticated attackers can permanently delete arbitrary posts, pages, products, and media attachments on any WordPress site running the Photo Reviews for WooCommerce plugin through version 1.2.30. The plugin accepts attacker-controlled post IDs in the public wcpr_image_upload_id parameter of a review submission and stores them as the review's 'reviews-images' comment meta without verifying that those IDs belong to attachments owned by the submitter; when the review is later deleted, the delete_reviews_image() handler unconditionally calls wp_delete_post( $id, true ) on every stored ID. Because the trigger is a privileged action - an administrator deleting the planted review, or WordPress's built-in wp_scheduled_delete cron emptying the comment trash roughly 30 days after the review is trashed - this is a credible high-integrity, high-availability issue rather than an instantly weaponizable one, and no public exploit code or CISA KEV entry was identified at time of analysis. | HIGH | 8.1 | 0.3% | 41 |
No patch
|
| CVE-2026-103071 | Unauthenticated code injection in the VillaTheme 'Thank You Page Customizer for WooCommerce' plugin, versions up to and including 1.2.3, lets a remote attacker who can reach a site running the plugin cause arbitrary code to be generated and executed, primarily threatening the integrity of the WordPress installation (CVSS 3.1 base 7.5, vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N per independent assessment). Any store that has both WooCommerce and this specific plugin installed and active is exposed, requires no credentials or user interaction, and is exploitable against default configurations. At time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified, and no vendor-released fixed version was found in the available data, so the practical risk is bounded by the narrow deployment scope of this relatively uncommon plugin rather than by any mass-exploitation signal. | HIGH | 7.5 | 0.2% | 38 |
No patch
|
| CVE-2026-81786 | Broken access control in the VillaTheme Thank You Page Customizer for WooCommerce plugin (all versions through 1.2.2) exposes WooCommerce order data to unauthenticated remote attackers. The missing authorization check (CWE-862) on one or more plugin endpoints allows any network-reachable party to retrieve order-associated confidential data without credentials, consistent with the CVSS C:H/PR:N/UI:N vector reported by Patchstack. No public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 7.5 | 0.2% | 38 |
No patch
|
| CVE-2022-41623 | Sensitive Data Exposure in Villatheme ALD - AliExpress Dropshipping and Fulfillment for WooCommerce premium plugin <= 1.1.0 on WordPress. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | HIGH | 7.5 | 0.7% | 38 |
No patch
|
| CVE-2026-100517 | Unauthenticated Insecure Direct Object Reference (IDOR) in the Photo Reviews for WooCommerce WordPress plugin, affecting all versions up to and including 1.2.30, allows remote attackers with no credentials and no user interaction to reference objects they should not be authorized to reach, degrading availability of the affected site's review functionality (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Exploitation requires only that the plugin be installed and active on a network-reachable WordPress/WooCommerce installation; no special feature toggle or non-default configuration is named in the advisory. There is no public exploit code identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), so exposure is currently driven by the low attack complexity and the unauthenticated, remote nature of the flaw rather than by observed in-the-wild activity. | HIGH | 7.5 | 0.3% | 38 |
No patch
|
| CVE-2026-100161 | Stored DOM-based cross-site scripting in the VillaTheme Photo Reviews for WooCommerce plugin through version 1.2.30 lets unauthenticated visitors inject arbitrary web scripts into review-related comment meta, which execute when a shopper or admin later loads a product page displaying the affected review. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, and the only gate is the publicly emitted `wcpr_image_upload` nonce, so no authentication, capability, or attachment-ownership check is required. No public exploit identified at time of analysis, and there is no CISA KEV confirmation of active exploitation. | HIGH | 7.2 | 0.3% | 36 |
No patch
|