Skip to content
OpenAdvisories

Vendor

WPFactory

51 known vulnerabilities.

Products

Wishlist for WooCommerce 4 Products, Order & Customers Export for WooCommerce 3 Advanced WooCommerce Product Sales Reporting 3 EAN for WooCommerce 3 Cost of Goods for WooCommerce 3 Free Shipping Bar: Amount Left for Free Shipping for WooCommerce 2 Back Button Widget 2 Adverts 2 Product XML Feed Manager for WooCommerce 2 Min Max Step Quantity Limits Manager for WooCommerce 2 Helpdesk Support Ticket System for WooCommerce 2 Additional Custom Product Tabs for WooCommerce 2 Product Notes Tab & Private Admin Notes for WooCommerce 1 Sitewide Discount for WooCommerce: Apply Discount to All Products 1 Product Filter by WBW 1 Email Verification for WooCommerce 1 Slugs Manager 1 Maximum Products per User for WooCommerce 1 Product Excel Import Export & Bulk Edit for WooCommerce 1 Scheduled & Automatic Order Status Controller for WooCommerce 1 EU/UK VAT Manager for WooCommerce 1 Additional Custom Emails & Recipients for WooCommerce 1 Quantity Dynamic Pricing & Bulk Discounts for WooCommerce 1 Download Plugins and Themes from Dashboard 1 Change Add to Cart Button Text for WooCommerce 1 WPFactory Helper 1 WP Currency Exchange Rates 1 Awesome Shortcodes 1 CRM ERP Business Solution 1 Custom CSS, JS & PHP 1 Coupons & Add to Cart by URL Links for WooCommerce 1 Custom Checkout Fields for WooCommerce 1 MSRP (RRP) Pricing for WooCommerce 1
All Critical High Medium Low Exploited only Public exploit

32 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-24992

    WordPress Advanced WooCommerce Product Sales Reporting plugin <= 4.1.2 - Sensitive Data Exposure vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in WPFactory Advanced WooCommerce Product Sales Reporting webd-woocommerce-advanced-reporting-statistics allows Retrieve Embedded Sensitive Data.This issue affects Advanced WooCommerce Product Sa…

    WPFactory Advanced WooCommerce Product Sales Reporting Web / CMS
  • Medium 6.5
    CVE-2025-69334

    WordPress Wishlist for WooCommerce plugin <= 3.3.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Wishlist for WooCommerce wish-list-for-woocommerce allows Stored XSS.This issue affects Wishlist for WooCommerce: from n/a through <= 3.3.0.

    WPFactory Wishlist for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-62096

    WordPress Maximum Products per User for WooCommerce plugin <= 4.4.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Maximum Products per User for WooCommerce maximum-products-per-user-for-woocommerce allows Stored XSS.This issue affects Maximum Products per User …

    WPFactory Maximum Products per User for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-68528

    WordPress Free Shipping Bar: Amount Left for Free Shipping for WooCommerce plugin <= 2.4.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Free Shipping Bar: Amount Left for Free Shipping for WooCommerce amount-left-free-shipping-woocommerce allows Stored XSS.This issue affects Free Sh…

    WPFactory Free Shipping Bar: Amount Left for Free Shipping for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-57911

    WordPress Adverts Plugin <= 1.4 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Adverts adverts-click-tracker allows DOM-Based XSS.This issue affects Adverts: from n/a through <= 1.4.

    WPFactory Adverts
  • Medium 4.3
    CVE-2025-57972

    WordPress Helpdesk Support Ticket System for WooCommerce plugin <= 2.1.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPFactory Helpdesk Support Ticket System for WooCommerce support-ticket-system-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Helpdesk Support Ticket System for…

    WPFactory Helpdesk Support Ticket System for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-58985

    WordPress Additional Custom Product Tabs for WooCommerce Plugin <= 1.7.3 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Additional Custom Product Tabs for WooCommerce product-tabs-for-woocommerce allows Stored XSS.This issue affects Additional Custom Product Tabs for…

    WPFactory Additional Custom Product Tabs for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-30959

    WordPress Product XML Feed Manager for WooCommerce <= 2.9.2 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in WPFactory Product XML Feed Manager for WooCommerce product-xml-feeds-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product XML Feed Manager for WooCommerce: fr…

    WPFactory Product XML Feed Manager for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-49319

    WordPress Wishlist for WooCommerce <= 3.2.3 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in WPFactory Wishlist for WooCommerce wish-list-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wishlist for WooCommerce: from n/a through <= 3.2.3.

    WPFactory Wishlist for WooCommerce Web / CMS
  • Medium 5.3
    CVE-2025-49987

    WordPress CRM ERP Business Solution plugin <= 1.13 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in WPFactory CRM ERP Business Solution crm-erp-business-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CRM ERP Business Solution: from n/a through <= 1.13.

    WPFactory CRM ERP Business Solution
  • Medium 4.3
    CVE-2025-49510

    WordPress Min Max Step Quantity Limits Manager for WooCommerce plugin <= 5.1.0 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in WPFactory Min Max Step Quantity Limits Manager for WooCommerce product-quantity-for-woocommerce allows Cross Site Request Forgery.This issue affects Min Max Step Quantity Limits Manager for WooCommerce: from …

    WPFactory Min Max Step Quantity Limits Manager for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-48254

    WordPress Change Add to Cart Button Text for WooCommerce plugin <= 2.2.2 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Change Add to Cart Button Text for WooCommerce add-to-cart-button-labels-for-woocommerce allows Stored XSS.This issue affects Change Add to Cart Bu…

    WPFactory Change Add to Cart Button Text for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-48253

    WordPress Free Shipping Bar: Amount Left for Free Shipping for WooCommerce plugin <= 2.4.6 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Free Shipping Bar: Amount Left for Free Shipping for WooCommerce amount-left-free-shipping-woocommerce allows Stored XSS.This issue affects Free Sh…

    WPFactory Free Shipping Bar: Amount Left for Free Shipping for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-48251

    WordPress Additional Custom Emails & Recipients for WooCommerce plugin <= 3.5.1 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Additional Custom Emails & Recipients for WooCommerce custom-emails-for-woocommerce allows Stored XSS.This issue affects Additional Custom Emails &…

    WPFactory Additional Custom Emails & Recipients for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-48252

    WordPress Back Button Widget plugin <= 1.6.8 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Back Button Widget back-button-widget allows Stored XSS.This issue affects Back Button Widget: from n/a through <= 1.6.8.

    WPFactory Back Button Widget
  • Medium 6.5
    CVE-2025-48250

    WordPress Coupons & Add to Cart by URL Links for WooCommerce plugin <= 1.7.7 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Coupons & Add to Cart by URL Links for WooCommerce url-coupons-for-woocommerce-by-algoritmika allows Stored XSS.This issue affects Coupons & Add to…

    WPFactory Coupons & Add to Cart by URL Links for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-48249

    WordPress EAN for WooCommerce plugin <= 5.4.6 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory EAN for WooCommerce ean-for-woocommerce allows Stored XSS.This issue affects EAN for WooCommerce: from n/a through <= 5.4.6.

    WPFactory EAN for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-48248

    WordPress Sitewide Discount for WooCommerce: Apply Discount to All Products plugin <= 2.2.1 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Sitewide Discount for WooCommerce: Apply Discount to All Products global-shop-discount-for-woocommerce allows Stored XSS.This issue affects Sitewid…

    WPFactory Sitewide Discount for WooCommerce: Apply Discount to All Products Web / CMS
  • Medium 6.5
    CVE-2025-48240

    WordPress Cost of Goods for WooCommerce plugin <= 3.7.0 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Cost of Goods for WooCommerce cost-of-goods-for-woocommerce allows Stored XSS.This issue affects Cost of Goods for WooCommerce: from n/a through <=…

    WPFactory Cost of Goods for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-48239

    WordPress Product Notes Tab & Private Admin Notes for WooCommerce plugin <= 3.1.0 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Product Notes Tab & Private Admin Notes for WooCommerce product-notes-for-woocommerce allows Stored XSS.This issue affects Product Notes Tab & Priv…

    WPFactory Product Notes Tab & Private Admin Notes for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-48237

    WordPress Wishlist for WooCommerce plugin <= 3.2.2 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Wishlist for WooCommerce wish-list-for-woocommerce allows Stored XSS.This issue affects Wishlist for WooCommerce: from n/a through <= 3.2.2.

    WPFactory Wishlist for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-47504

    WordPress Custom Checkout Fields for WooCommerce plugin <= 1.8.3 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Custom Checkout Fields for WooCommerce custom-checkout-fields-for-woocommerce allows Stored XSS.This issue affects Custom Checkout Fields for WooCo…

    WPFactory Custom Checkout Fields for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-26749

    WordPress Additional Custom Product Tabs for WooCommerce plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Additional Custom Product Tabs for WooCommerce product-tabs-for-woocommerce allows Stored XSS.This issue affects Additional Custom Product Tabs for…

    WPFactory Additional Custom Product Tabs for WooCommerce Web / CMS
  • Medium 5.3
    CVE-2025-31848

    WordPress WordPress Adverts Plugin plugin <= 1.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPFactory Adverts adverts-click-tracker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Adverts: from n/a through <= 1.4.

    WPFactory Adverts
  • Medium 6.5
    CVE-2025-31598

    WordPress Quantity Dynamic Pricing & Bulk Discounts for WooCommerce plugin <= 4.0.3 - Stored Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Quantity Dynamic Pricing & Bulk Discounts for WooCommerce wholesale-pricing-woocommerce allows Stored XSS.This issue affects Quantity Dynamic Prici…

    WPFactory Quantity Dynamic Pricing & Bulk Discounts for WooCommerce Web / CMS
  • Medium 4.3
    CVE-2025-22673

    WordPress EAN Barcode Generator <= 5.3.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPFactory EAN for WooCommerce ean-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EAN for WooCommerce: from n/a through <= 5.3.5.

    WPFactory EAN for WooCommerce Web / CMS
  • Medium 4.7
    CVE-2025-30781

    WordPress Scheduled & Automatic Order Status Controller for WooCommerce plugin <= 3.7.1 - Open Redirection Vulnerability

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in WPFactory Scheduled & Automatic Order Status Controller for WooCommerce order-status-rules-for-woocommerce allows Phishing.This issue affects Scheduled & Automatic Order Status Controller fo…

    WPFactory Scheduled & Automatic Order Status Controller for WooCommerce Web / CMS
  • Medium 5.4
    CVE-2023-23868

    WordPress Cost of Goods for WooCommerce plugin <= 2.8.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPFactory Cost of Goods for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cost of Goods for WooCommerce: from n/a through 2.8.6.

    WPFactory Cost of Goods for WooCommerce Web / CMS
  • Medium 5.3
    CVE-2024-31276

    WordPress Products, Order & Customers Export for WooCommerce plugin <= 2.0.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPFactory Products, Order & Customers Export for WooCommerce.This issue affects Products, Order & Customers Export for WooCommerce: from n/a through 2.0.8.

    WPFactory Products, Order & Customers Export for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2024-35162

    Path traversal vulnerability exists in Download Plugins and Themes from Dashboard versions prior to 1.8.6. If this vuln…

    WPFactory Download Plugins and Themes from Dashboard
  • Medium 4.3
    CVE-2024-30536

    WordPress Slugs Manager plugin <= 2.6.7 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in WPFactory Slugs Manager.This issue affects Slugs Manager: from n/a through 2.6.7.

    WPFactory Slugs Manager
  • Medium 6.5
    CVE-2023-51399

    WordPress Back Button Widget Plugin <= 1.6.3 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Back Button Widget allows Stored XSS.This issue affects Back Button Widget: from n/a through 1.6.3.

    WPFactory Back Button Widget