Log in Start free

WPSwings

Products

ProductCVEsExploitedLatest
Return Refund and Exchange For WooCommerce4–Nov 21, 2025
Ultimate Gift Cards for WooCommerce4–Jun 3, 2025
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments3–Jan 17, 2026
Subscriptions for WooCommerce3–Aug 1, 2026
WooCommerce Ultimate Gift Card2–Sep 9, 2025
WooCommerce Ultimate Points And Rewards1–Nov 13, 2025
Points and Rewards for WooCommerce1–Jul 11, 2026
Upsell Funnel Builder for WooCommerce – Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups.1–Apr 25, 2025
One Click Upsell Funnel for Woocommerce1–Dec 21, 2024

Exploited and recent CVEs

  • CVE-2026-15414 High 8.8 Subscriptions for WooCommerce <= 2.0.0 - Authenticated (Contributor+) Privilege Escalation via '_wps_plan_user_role' Membership Plan Meta 0.8%
  • CVE-2026-15397 High 7.2 Subscriptions for WooCommerce <= 2.0.0 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation via wps_sfw_install_plugin_configuration AJAX Action 0.6%
  • CVE-2026-10628 Medium 4.3 Points and Rewards for WooCommerce <= 2.10.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via Multiple AJAX Actions 0.6%
  • CVE-2026-1926 Medium 5.3 Subscriptions for WooCommerce <= 1.9.2 - Missing Authorization to Unauthenticated Arbitrary Subscription Cancellation 0.3%
  • CVE-2025-14450 Medium 6.5 Wallet System for WooCommerce <= 2.7.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Wallet Balance Manipulation 0.3%
  • CVE-2025-12881 Medium 5.4 Return Refund and Exchange For WooCommerce <= 4.5.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Order Message Read 0.2%
  • CVE-2025-12086 Medium 4.3 Return Refund and Exchange For WooCommerce <= 4.5.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Refund Request Cancellation 0.2%
  • CVE-2025-64267 Medium 4.3 WordPress WooCommerce Ultimate Points And Rewards plugin <= 2.10.2 - Sensitive Data Exposure vulnerability 0.2%
  • CVE-2025-47569 Critical 9.3 WordPress WooCommerce Ultimate Gift Card plugin <= 2.9.6 - SQL Injection vulnerability 0.6%
  • CVE-2025-5103 Medium 4.9 Ultimate Gift Cards for WooCommerce <= 3.1.4 - Authenticated (Administrator+) SQL Injection via wps_wgm_save_post Function 0.4%
  • CVE-2025-3743 Medium 5.3 Upsell Funnel Builder for WooCommerce <= 3.0.0 - Unauthenticated Order Manipulation 0.4%
  • CVE-2024-13724 Medium 4.3 Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction <= 2.6.2 - Missing Authorization 0.2%
  • CVE-2024-13682 Medium 4.3 Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction <= 2.6.2 - Cross-Site Request Forgery 0.1%
  • CVE-2024-13692 Medium 5.4 Return Refund and Exchange For WooCommerce <= 4.4.5 - Authenticated (Subscriber+) Insecure Direct Object Reference 0.3%
  • CVE-2024-13641 Medium 5.9 Return Refund and Exchange For WooCommerce <= 4.4.5 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory 0.5%
  • CVE-2024-11423 High 7.5 Ultimate Gift Cards for WooCommerce <= 3.0.6 - Missing Authorization to Infinite Money Glitch 0.8%
  • CVE-2024-11938 Medium 6.4 One Click Upsell Funnel for WooCommerce <= 3.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via wps_wocuf_pro_yes Shortcode 0.4%
  • CVE-2024-53740 High 7.1 WordPress WooCommerce Ultimate Gift Card plugin < 2.9.1 - Reflected Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2024-1857 Medium 5.3 Ultimate Gift Cards for WooCommerce – Create, Redeem & Manage Digital Gift Certificates with Personalized Templates <= 2.6.6 - Missing Authorization to Unauthenticated Information Exposure 0.3%
  • CVE-2021-4391 Medium 4.3 Ultimate Gift Cards for WooCommerce <= 2.1.1 - Cross-Site Request Forgery Bypass 0.5%