Skip to content
OpenAdvisories

Vendor

wpclever

39 known vulnerabilities.

Products

WPC Smart Quick View for WooCommerce 5 WPC Smart Messages for WooCommerce 4 WPC Smart Wishlist for WooCommerce 4 WPC Product Bundles for WooCommerce 4 WPC Product Options for WooCommerce 3 WPC Shop as a Customer for WooCommerce 3 WPC Badge Management for WooCommerce 3 WPC Frequently Bought Together for WooCommerce 2 WPC Smart Compare for WooCommerce 2 WPC Name Your Price for WooCommerce 1 WPC Estimated Delivery Date for WooCommerce 1 WPC Smart Upsell Funnel for WooCommerce 1 WPC Order Notes for WooCommerce 1 WPC Grouped Product for WooCommerce 1 WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce 1 WPC Countdown Timer for WooCommerce 1 WPC Admin Columns 1 WPC Composite Products for WooCommerce 1
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • High 7.2
    CVE-2026-97660

    WPC Product Options for WooCommerce <= 4.0.5 - Unauthenticated Stored Cross-Site Scripting via wpcpo-* Array Key via Multipart Field Name

    The WPC Product Options for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wpcpo-* Array Key via Multipart Field Name in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. Th…

    wpclever WPC Product Options for WooCommerce Web / CMS
  • High 8.8
    CVE-2026-95687

    WPC Shop as a Customer for WooCommerce <= 2.0.0 - Authenticated (Subscriber+) Privilege Escalation via Missing Role Check on Target User to wpcsa_login AJAX Endpoint

    The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0 This is due to the plugin not properly validating the target user's role prior to issuing a …

    wpclever WPC Shop as a Customer for WooCommerce Web / CMS
  • High 7.2
    CVE-2026-93836

    WPC Product Bundles for WooCommerce <= 8.6.6 - Unauthenticated Stored Cross-Site Scripting via 'qty' Parameter

    The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qty' parameter in all versions up to, and including, 8.6.6 due to insufficient input sanitization and output escaping. This makes it possible fo…

    wpclever WPC Product Bundles for WooCommerce Web / CMS
  • High 7.5
    CVE-2026-49061

    WordPress WPC Product Options for WooCommerce plugin <= 3.2.1 - Arbitrary File Download vulnerability

    Unauthenticated Arbitrary File Download in WPC Product Options for WooCommerce <= 3.2.1 versions.

    wpclever WPC Product Options for WooCommerce Web / CMS
  • High 7.5
    CVE-2026-48883

    WordPress WPC Product Bundles for WooCommerce plugin <= 8.5.3 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in WPC Product Bundles for WooCommerce <= 8.5.3 versions.

    wpclever WPC Product Bundles for WooCommerce Web / CMS
  • High 7.5
    CVE-2025-60248

    WordPress WPC Product Options for WooCommerce plugin <= 3.1.3 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WPClever WPC Product Options for WooCommerce wpc-product-options allows PHP Local File Inclusion.This issue affects WPC Product Options fo…

    wpclever WPC Product Options for WooCommerce Web / CMS
  • High 7.5
    CVE-2025-12115

    WPC Name Your Price for WooCommerce <= 2.1.9 - Unauthenticated Price Alteration

    The WPC Name Your Price for WooCommerce plugin for WordPress is vulnerable to unauthorized price alteration in all versions up to, and including, 2.1.9. This is due to the plugin not disabling the ability to name a custom price when it has been specifically d…

    wpclever WPC Name Your Price for WooCommerce Web / CMS
  • High 8.8
    CVE-2025-3418

    WPC Admin Columns 2.0.6 - 2.1.0 - Authenticated (Subscriber+) Privilege Escalation via User Meta Update

    The WPC Admin Columns plugin for WordPress is vulnerable to privilege escalation in versions 2.0.6 to 2.1.0. This is due to the plugin not properly restricting user meta values that can be updated through the ajax_edit_save() function. This makes it possible …

    wpclever WPC Admin Columns Web / CMS
  • High 8.8
    CVE-2025-30825

    WordPress WPC Smart Linked Products plugin <= 1.3.5 - Privilege Escalation vulnerability

    Missing Authorization vulnerability in WPClever WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce wpc-smart-linked-products allows Privilege Escalation.This issue affects WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce: from …

    wpclever WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce Web / CMS
  • High 8.8
    CVE-2025-30772 Public exploit

    WordPress WPC Smart Upsell Funnel for WooCommerce plugin <= 3.0.4 - Arbitrary Option Update to Privilege Escalation vulnerability

    Missing Authorization vulnerability in WPClever WPC Smart Upsell Funnel for WooCommerce wpc-smart-upsell-funnel allows Privilege Escalation.This issue affects WPC Smart Upsell Funnel for WooCommerce: from n/a through <= 3.0.4.

    wpclever WPC Smart Upsell Funnel for WooCommerce Web / CMS
  • High 8.1
    CVE-2024-12432

    WPC Shop as a Customer for WooCommerce <= 1.2.8 - Authentication Bypass Due to Insufficiently Unique Key

    The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to account takeover and privilege escalation in all versions up to, and including, 1.2.8. This is due to the 'generate_key' function not producing a sufficiently random value. This …

    wpclever WPC Shop as a Customer for WooCommerce Web / CMS
  • High 8.8
    CVE-2024-10436

    WPC Smart Messages for WooCommerce <= 4.2.1 - Authenticated (Subscriber+) Local File Inclusion

    The WPC Smart Messages for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.2.1 via the get_condition_value function. This makes it possible for authenticated attackers, with Subscriber-level acces…

    wpclever WPC Smart Messages for WooCommerce Web / CMS
  • High 8.8
    CVE-2024-50416

    WordPress WPC Shop as a Customer for WooCommerce plugin <= 1.2.6 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in WPClever WPC Shop as a Customer for WooCommerce wpc-shop-as-customer allows Object Injection.This issue affects WPC Shop as a Customer for WooCommerce: from n/a through <= 1.2.6.

    wpclever WPC Shop as a Customer for WooCommerce Web / CMS