wpdesk
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| Flexible Refund and Return Order for WooCommerce | 3 | – | Jul 13, 2026 |
| Flexible PDF Coupons | 2 | – | Sep 30, 2026 |
| Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later | 2 | – | Feb 18, 2025 |
| ShopMagic | 2 | – | Dec 30, 2025 |
| Flexible PDF Invoices for WooCommerce & WordPress | 1 | – | Sep 22, 2025 |
| Flexible Quantity – Measurement Price Calculator for WooCommerce | 1 | – | Sep 11, 2026 |
| Flexible Subscriptions | 1 | – | Aug 19, 2026 |
| Autopay dla WooCommerce | 1 | – | Jul 23, 2026 |
| ShopMagic – email automation for WordPress | 1 | – | Oct 14, 2026 |
| Flexible Chat | 1 | – | Oct 30, 2026 |
| Flexible Checkout Fields for WooCommerce – WooCommerce Checkout Manager | 1 | – | Jun 7, 2023 |
| Flexible Cookies | 1 | – | Mar 27, 2025 |
Exploited and recent CVEs
- CVE-2026-116861 WordPress Flexible Chat plugin <= 1.1.0 - Sensitive Data Exposure vulnerability 0.3%
- CVE-2026-103367 ShopMagic <= 4.9.0 - Unauthenticated Local File Inclusion via 'billing.first_name' Parameter 1.0%
- CVE-2026-62081 WordPress Flexible PDF Coupons plugin <= 1.14.11 - Insecure Direct Object References (IDOR) vulnerability 0.2%
- CVE-2026-62136 WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.21 - Broken Access Control vulnerability 0.3%
- CVE-2026-73364 WordPress Flexible Subscriptions plugin <= 1.8.1 - PHP Object Injection vulnerability 0.6%
- CVE-2026-57425 WordPress Autopay dla WooCommerce plugin <= 2.2.27 - Broken Access Control vulnerability 0.3%
- CVE-2026-57402 WordPress Flexible Refund and Return Order for WooCommerce plugin <= 1.0.51 - Cross Site Scripting (XSS) vulnerability 0.2%
- CVE-2025-69093 WordPress ShopMagic plugin <= 4.7.2 - Broken Access Control vulnerability 0.2%
- CVE-2025-12621 Flexible Refund and Return Order for WooCommerce <= 1.0.42 - Incorrect Authorization to Authenticated (Contributor+) Refund Status Update 0.3%
- CVE-2025-59578 WordPress ShopMagic plugin <= 4.5.6 - Sensitive Data Exposure vulnerability 0.3%
- CVE-2025-10570 Flexible Refund and Return Order for WooCommerce <= 1.0.38 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Refund 0.2%
- CVE-2025-57977 WordPress Flexible PDF Invoices for WooCommerce & WordPress Plugin <= 6.0.13 - Cross Site Request Forgery (CSRF) Vulnerability 0.2%
- CVE-2025-30805 WordPress Flexible Cookies plugin <= 1.1.8 - Cross Site Request Forgery (CSRF) vulnerability 0.2%
- CVE-2024-13718 Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later <= 1.2.26 - Cross-Site Request Forgery to Wishlist Creation/Modification 0.2%
- CVE-2024-13696 Flexible Wishlist for WooCommerce <= 1.2.25 - Unauthenticated Stored Cross-Site Scripting via wishlist_name Parameter 0.4%
- CVE-2025-22825 WordPress Flexible PDF Coupons plugin < 1.10.3 - Stored Cross Site Scripting (XSS) vulnerability 0.2%
- CVE-2020-36731 Flexible Checkout Fields for WooCommerce <= 2.3.1 - Unauthenticated Arbitrary Plugin Settings Update 1.3%