Skip to content
OpenAdvisories

Vendor

FantasticPlugins

10 known vulnerabilities.

FantasticPlugins at a glance

Last 12 months
3
Critical · all time
2
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 1 December 2025: 1 vulnerability Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 1 vulnerability, 1 critical Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 1 vulnerability August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202610
Jun 202600
May 202600
Apr 202600
Mar 202611
Feb 202600
Jan 202600
Dec 202510
Nov 202500
Oct 202540
Sep 202500
Aug 202500
Jul 202500
Jun 202511
May 202510
Apr 202500
Mar 202510
Feb 202500
Jan 202500
Dec 202400

Products

SUMO Memberships for WooCommerce 3 SUMO Affiliates Pro 3 WooCommerce Recover Abandoned Cart 2 SUMO Reward Points for WooCommerce 1 SUMO Reward Points 1
All Critical High Medium Low Exploited only Public exploit

10 results · Feed

  • High 7.2
    CVE-2026-7534

    SUMO Reward Points for WooCommerce <= 32.7.0 - Unauthenticated Stored Cross-Site Scripting via 'reason' Parameter

    The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REST API endpoint `/wp-json/wc-srp/v1/earning` in versions up to, and including, 32.7.0. This is due to the `user_has_cap` filter in the `SRP_REST…

    FantasticPlugins SUMO Reward Points for WooCommerce Web / CMS
  • Critical 9.8
    CVE-2026-24989

    WordPress SUMO Affiliates Pro plugin < 11.4.0 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in FantasticPlugins SUMO Affiliates Pro affs allows Object Injection.This issue affects SUMO Affiliates Pro: from n/a through < 11.4.0.

    FantasticPlugins SUMO Affiliates Pro
  • High 7.5
    CVE-2025-64222

    WordPress WooCommerce Recover Abandoned Cart plugin <= 24.6.0 - Arbitrary Content Deletion vulnerability

    Missing Authorization vulnerability in FantasticPlugins WooCommerce Recover Abandoned Cart rac allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Recover Abandoned Cart: from n/a through <= 24.6.0.

    FantasticPlugins WooCommerce Recover Abandoned Cart Web / CMS
  • Medium 4.3
    CVE-2025-64228

    WordPress SUMO Affiliates Pro plugin <= 11.0.0 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in FantasticPlugins SUMO Affiliates Pro affs allows Retrieve Embedded Sensitive Data.This issue affects SUMO Affiliates Pro: from n/a through <= 11.0.0.

    FantasticPlugins SUMO Affiliates Pro
  • High 7.1
    CVE-2025-62005

    WordPress SUMO Memberships for WooCommerce plugin < 7.8.0 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in FantasticPlugins SUMO Memberships for WooCommerce sumomemberships allows Cross Site Request Forgery.This issue affects SUMO Memberships for WooCommerce: from n/a through < 7.8.0.

    FantasticPlugins SUMO Memberships for WooCommerce Web / CMS
  • High 8.8
    CVE-2025-60222

    WordPress SUMO Memberships for WooCommerce plugin <= 7.8.0 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in FantasticPlugins SUMO Memberships for WooCommerce sumomemberships allows Privilege Escalation.This issue affects SUMO Memberships for WooCommerce: from n/a through <= 7.8.0.

    FantasticPlugins SUMO Memberships for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-52757

    WordPress SUMO Memberships for WooCommerce plugin < 7.8.0 - Arbitrary Content Deletion vulnerability

    Missing Authorization vulnerability in FantasticPlugins SUMO Memberships for WooCommerce sumomemberships allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SUMO Memberships for WooCommerce: from n/a through < 7.8.0.

    FantasticPlugins SUMO Memberships for WooCommerce Web / CMS
  • Critical 10.0
    CVE-2025-32291

    WordPress SUMO Affiliates Pro plugin < 11.1.0 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in FantasticPlugins SUMO Affiliates Pro affs allows Using Malicious Files.This issue affects SUMO Affiliates Pro: from n/a through < 11.1.0.

    FantasticPlugins SUMO Affiliates Pro
  • High 8.3
    CVE-2025-32925

    WordPress SUMO Reward Points plugin <= 30.7.0 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in FantasticPlugins SUMO Reward Points rewardsystem allows PHP Local File Inclusion.This issue affects SUMO Reward Points: from n/a through <…

    FantasticPlugins SUMO Reward Points
  • High 8.1
    CVE-2025-0956

    WooCommerce Recover Abandoned Cart <= 24.4.0 - Unauthenticated PHP Object Injection

    The WooCommerce Recover Abandoned Cart plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 24.4.0 via deserialization of untrusted input from the 'raccookie_guest_email' cookie. This makes it possible for unauthent…

    FantasticPlugins WooCommerce Recover Abandoned Cart Web / CMS