Skip to content
OpenAdvisories

Product · WP Swings

Subscriptions for WooCommerce

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.8
    CVE-2026-15414

    Subscriptions for WooCommerce <= 2.0.0 - Authenticated (Contributor+) Privilege Escalation via '_wps_plan_user_role' Membership Plan Meta

    The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.0.0. This is due to the `save_meta_boxes()` function persisting the `_wps_plan_user_role` membership plan meta from `$_POST` witho…

    WP Swings Subscriptions for WooCommerce Web / CMS
  • High 7.2
    CVE-2026-15397

    Subscriptions for WooCommerce <= 2.0.0 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation via wps_sfw_install_plugin_configuration AJAX Action

    The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action via the wps_sfw_install_…

    WP Swings Subscriptions for WooCommerce Web / CMS
  • High 7.5
    CVE-2026-56061

    WordPress Subscriptions for WooCommerce plugin <= 1.9.5 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Subscriptions for WooCommerce <= 1.9.5 versions.

    WP Swings Subscriptions for WooCommerce Web / CMS
  • High 7.5
    CVE-2026-24372

    WordPress Subscriptions for WooCommerce plugin <= 1.8.10 - Bypass Vulnerability vulnerability

    Authentication Bypass by Spoofing vulnerability in WP Swings Subscriptions for WooCommerce subscriptions-for-woocommerce allows Input Data Manipulation.This issue affects Subscriptions for WooCommerce: from n/a through <= 1.8.10.

    WP Swings Subscriptions for WooCommerce Web / CMS