Skip to content
OpenAdvisories

Vendor

StoreApps

12 known vulnerabilities.

Products

Smart Manager 4 Stock Manager for WooCommerce 2 Affiliate For WooCommerce (WordPress plugin) 2 Smart Manager – WooCommerce Bulk Edit: Products, Orders, Users & More (Spreadsheet) 1 WooCommerce Stock Manager 1 News Announcement Scroll 1 News Announcement Scroll (WordPress plugin) 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 8.8
    CVE-2026-18443

    Smart Manager <= 8.97.0 - Authenticated (Subscriber+) SQL Injection to Privilege Escalation via 'access_privileges' Parameter

    The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via the 'access_privileges' parameter in all versions up to, and including, 8.97.0 due to insufficient escaping on the user s…

    StoreApps Smart Manager – WooCommerce Bulk Edit: Products, Orders, Users & More (Spreadsheet) Web / CMS
  • High 7.1
    CVE-2026-57704

    WordPress Smart Manager plugin <= 8.90.0 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Smart Manager <= 8.90.0 versions.

    StoreApps Smart Manager
  • High 8.8
    CVE-2026-45216

    WordPress Smart Manager plugin <= 8.85.0 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in StoreApps Smart Manager allows Privilege Escalation. This issue affects Smart Manager: from n/a through 8.85.0.

    StoreApps Smart Manager
  • High 7.6
    CVE-2025-22710 Public exploit

    WordPress Smart Manager Plugin <= 8.52.0 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in storeapps Smart Manager smart-manager-for-wp-e-commerce allows Blind SQL Injection.This issue affects Smart Manager: from n/a through <= 8.52.0.

    StoreApps Smart Manager
  • High 8.8
    CVE-2023-5663

    News Announcement Scroll <= 9.0.0 - Authenticated (Contributor+) SQL Injection via Shortcode

    The News Announcement Scroll plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 9.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing …

    StoreApps News Announcement Scroll Web / CMS
  • High 8.8
    CVE-2021-34619

    Cross-Site Request Forgery in WooCommerce Stock Manager WordPress Plugin

    The WooCommerce Stock Manager WordPress plugin is vulnerable to Cross-Site Request Forgery leading to Arbitrary File Upload in versions up to, and including, 2.5.7 due to missing nonce and file validation in the /woocommerce-stock-manager/trunk/admin/views/im…

    StoreApps WooCommerce Stock Manager Web / CMS