Filtered by vendor Wpclever Subscriptions
Total 26 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-12432 2 Wordpress, Wpclever 2 Wordpress, Wpc Shop As A Customer For Woocommerce 2026-04-15 8.1 High
The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to account takeover and privilege escalation in all versions up to, and including, 1.2.8. This is due to the 'generate_key' function not producing a sufficiently random value. This makes it possible for authenticated attackers, with Subscriber-level access and above, to log in as site administrators, granted they have triggered the ajax_login() function which generates a unique key that can be used to log in.
CVE-2023-6494 1 Wpclever 1 Wpc Smart Quick View For Woocommerce 2026-04-08 4.4 Medium
The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVE-2024-30537 1 Wpclever 1 Wpc Badge Management For Woocommerce 2024-11-21 4.3 Medium
Missing Authorization vulnerability in WPClever WPC Badge Management for WooCommerce.This issue affects WPC Badge Management for WooCommerce: from n/a through 2.4.0.
CVE-2022-1465 1 Wpclever 1 Wpc Smart Wishlist For Woocommerce 2024-11-21 6.1 Medium
The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.9 does not sanitise and escape a parameter before outputting it back in an attribute via an AJAX action, leading to a Reflected Cross-Site Scripting issue.
CVE-2022-0397 1 Wpclever 1 Wpc Smart Wishlist For Woocommerce 2024-11-21 5.4 Medium
The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.4 does not sanitise and escape the key parameter before outputting it back in the wishlist_quickview AJAX action's response (available to any authenticated user), leading to a Reflected Cross-Site Scripting
CVE-2024-43312 1 Wpclever 1 Wpc Frequently Bought Together For Woocommerce 2024-11-13 5.4 Medium
Missing Authorization vulnerability in WPClever WPC Frequently Bought Together for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPC Frequently Bought Together for WooCommerce: from n/a through 7.1.9.