Skip to content
OpenAdvisories

Vendor

FantasticPlugins

10 known vulnerabilities.

Products

SUMO Memberships for WooCommerce 3 SUMO Affiliates Pro 3 WooCommerce Recover Abandoned Cart 2 SUMO Reward Points for WooCommerce 1 SUMO Reward Points 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 7.2
    CVE-2026-7534

    SUMO Reward Points for WooCommerce <= 32.7.0 - Unauthenticated Stored Cross-Site Scripting via 'reason' Parameter

    The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REST API endpoint `/wp-json/wc-srp/v1/earning` in versions up to, and including, 32.7.0. This is due to the `user_has_cap` filter in the `SRP_REST…

    FantasticPlugins SUMO Reward Points for WooCommerce Web / CMS
  • High 7.5
    CVE-2025-64222

    WordPress WooCommerce Recover Abandoned Cart plugin <= 24.6.0 - Arbitrary Content Deletion vulnerability

    Missing Authorization vulnerability in FantasticPlugins WooCommerce Recover Abandoned Cart rac allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Recover Abandoned Cart: from n/a through <= 24.6.0.

    FantasticPlugins WooCommerce Recover Abandoned Cart Web / CMS
  • High 7.1
    CVE-2025-62005

    WordPress SUMO Memberships for WooCommerce plugin < 7.8.0 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in FantasticPlugins SUMO Memberships for WooCommerce sumomemberships allows Cross Site Request Forgery.This issue affects SUMO Memberships for WooCommerce: from n/a through < 7.8.0.

    FantasticPlugins SUMO Memberships for WooCommerce Web / CMS
  • High 8.8
    CVE-2025-60222

    WordPress SUMO Memberships for WooCommerce plugin <= 7.8.0 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in FantasticPlugins SUMO Memberships for WooCommerce sumomemberships allows Privilege Escalation.This issue affects SUMO Memberships for WooCommerce: from n/a through <= 7.8.0.

    FantasticPlugins SUMO Memberships for WooCommerce Web / CMS
  • High 8.3
    CVE-2025-32925

    WordPress SUMO Reward Points plugin <= 30.7.0 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in FantasticPlugins SUMO Reward Points rewardsystem allows PHP Local File Inclusion.This issue affects SUMO Reward Points: from n/a through <…

    FantasticPlugins SUMO Reward Points
  • High 8.1
    CVE-2025-0956

    WooCommerce Recover Abandoned Cart <= 24.4.0 - Unauthenticated PHP Object Injection

    The WooCommerce Recover Abandoned Cart plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 24.4.0 via deserialization of untrusted input from the 'raccookie_guest_email' cookie. This makes it possible for unauthent…

    FantasticPlugins WooCommerce Recover Abandoned Cart Web / CMS