Skip to content
OpenAdvisories

Vendor

wpdesk

17 known vulnerabilities.

Products

Flexible Refund and Return Order for WooCommerce 3 Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later 2 ShopMagic 2 Flexible PDF Coupons 2 Autopay dla WooCommerce 1 Flexible Cookies 1 ShopMagic – email automation for WordPress 1 Flexible Quantity – Measurement Price Calculator for WooCommerce 1 Flexible Chat 1 Flexible Subscriptions 1 Flexible PDF Invoices for WooCommerce & WordPress 1 Flexible Checkout Fields for WooCommerce – WooCommerce Checkout Manager 1
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-62081

    WordPress Flexible PDF Coupons plugin <= 1.14.11 - Insecure Direct Object References (IDOR) vulnerability

    Contributor Insecure Direct Object References (IDOR) in Flexible PDF Coupons <= 1.14.11 versions.

    wpdesk Flexible PDF Coupons
  • Medium 5.3
    CVE-2026-62136

    WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.21 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Flexible Quantity – Measurement Price Calculator for WooCommerce <= 2.3.21 versions.

    wpdesk Flexible Quantity – Measurement Price Calculator for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2026-57425

    WordPress Autopay dla WooCommerce plugin <= 2.2.27 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Autopay dla WooCommerce <= 2.2.27 versions.

    wpdesk Autopay dla WooCommerce Web / CMS
  • Medium 6.5
    CVE-2026-57402

    WordPress Flexible Refund and Return Order for WooCommerce plugin <= 1.0.51 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdesk Flexible Refund and Return Order for WooCommerce flexible-refund-and-return-order-for-woocommerce allows Stored XSS.This issue affects Flexible Refund…

    wpdesk Flexible Refund and Return Order for WooCommerce Web / CMS
  • Medium 5.3
    CVE-2025-69093

    WordPress ShopMagic plugin <= 4.7.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in wpdesk ShopMagic shopmagic-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShopMagic: from n/a through <= 4.7.2.

    wpdesk ShopMagic
  • Medium 5.3
    CVE-2025-12621

    Flexible Refund and Return Order for WooCommerce <= 1.0.42 - Incorrect Authorization to Authenticated (Contributor+) Refund Status Update

    The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on the 'create_refund' function in all versions up to, and including, 1.0.42. This makes it po…

    wpdesk Flexible Refund and Return Order for WooCommerce Web / CMS
  • Medium 5.8
    CVE-2025-59578

    WordPress ShopMagic plugin <= 4.5.6 - Sensitive Data Exposure vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in wpdesk ShopMagic shopmagic-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects ShopMagic: from n/a through <= 4.5.6.

    wpdesk ShopMagic
  • Medium 4.3
    CVE-2025-10570

    Flexible Refund and Return Order for WooCommerce <= 1.0.38 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Refund

    The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.38 via the save_refund_request() function. This makes it possible for authenticated attackers, with subs…

    wpdesk Flexible Refund and Return Order for WooCommerce Web / CMS
  • Medium 4.3
    CVE-2025-30805

    WordPress Flexible Cookies plugin <= 1.1.8 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in wpdesk Flexible Cookies flexible-cookies allows Cross Site Request Forgery.This issue affects Flexible Cookies: from n/a through <= 1.1.8.

    wpdesk Flexible Cookies
  • Medium 4.3
    CVE-2024-13718

    Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later <= 1.2.26 - Cross-Site Request Forgery to Wishlist Creation/Modification

    The Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.26. This is due to missing or incorrect nonce validation on several function…

    wpdesk Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later Web / CMS
  • Medium 6.5
    CVE-2025-22825

    WordPress Flexible PDF Coupons plugin < 1.10.3 - Stored Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdesk Flexible PDF Coupons flexible-coupons allows Stored XSS.This issue affects Flexible PDF Coupons: from n/a through < 1.10.3.

    wpdesk Flexible PDF Coupons