https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-48254.htmlhttps://patchthecve.com/cve/CVE-2025-48254.htmlWed, 17 Jun 2026 09:29:20 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Change Add to Cart Button Text for WooCommerce add-to-cart-button-labels-for-woocommerce allows Stored XSS.This issue affects Change Add to Cart Button Text for WooCommerce: from n/a throuhttps://patchthecve.com/cve/CVE-2025-48253.htmlhttps://patchthecve.com/cve/CVE-2025-48253.htmlWed, 17 Jun 2026 09:29:20 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Free Shipping Bar: Amount Left for Free Shipping for WooCommerce amount-left-free-shipping-woocommerce allows Stored XSS.This issue affects Free Shipping Bar: Amount Left for Free Shippinghttps://patchthecve.com/cve/CVE-2025-48252.htmlhttps://patchthecve.com/cve/CVE-2025-48252.htmlWed, 17 Jun 2026 09:29:20 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Back Button Widget back-button-widget allows Stored XSS.This issue affects Back Button Widget: from n/a through <= 1.6.8.https://patchthecve.com/cve/CVE-2024-13774.htmlhttps://patchthecve.com/cve/CVE-2024-13774.htmlWed, 17 Jun 2026 07:02:41 +0000MEDIUM 6.1: The Wishlist for WooCommerce: Multi Wishlists Per Customer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.7. This is due to missing or incorrect nonce validation on the 'save_to_multiple_wishlist' function. This makes it possible for unauthhttps://patchthecve.com/cve/CVE-2024-13525.htmlhttps://patchthecve.com/cve/CVE-2024-13525.htmlWed, 17 Jun 2026 07:02:11 +0000MEDIUM 6.5: The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.4 via Shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data incluhttps://patchthecve.com/cve/CVE-2024-13528.htmlhttps://patchthecve.com/cve/CVE-2024-13528.htmlWed, 17 Jun 2026 07:02:11 +0000HIGH 7.5: The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.9.5. This is due to the presence of a shortcode that will generate a confirmation link with a placeholder email. This makes it possible for authenticatehttps://patchthecve.com/cve/CVE-2024-10519.htmlhttps://patchthecve.com/cve/CVE-2024-10519.htmlWed, 17 Jun 2026 06:55:51 +0000MEDIUM 6.1: The Wishlist for WooCommerce: Multi Wishlists Per Customer PRO plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wtab' parameter in versions 3.0.8 to 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to https://patchthecve.com/cve/CVE-2024-44061.htmlhttps://patchthecve.com/cve/CVE-2024-44061.htmlWed, 17 Jun 2026 07:52:14 +0000HIGH 7.1: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory EU/UK VAT Manager for WooCommerce eu-vat-for-woocommerce.This issue affects EU/UK VAT Manager for WooCommerce: from n/a through <= 2.12.14.https://patchthecve.com/cve/CVE-2024-9377.htmlhttps://patchthecve.com/cve/CVE-2024-9377.htmlWed, 17 Jun 2026 08:24:26 +0000MEDIUM 6.1: The Products, Order & Customers Export for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.0.15. This makes it possible for unauthenticahttps://patchthecve.com/cve/CVE-2024-9205.htmlhttps://patchthecve.com/cve/CVE-2024-9205.htmlWed, 17 Jun 2026 08:24:08 +0000MEDIUM 6.1: The Maximum Products per User for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 4.2.8. This makes it possible for unauthenticated attackers to inject arbithttps://patchthecve.com/cve/CVE-2024-9384.htmlhttps://patchthecve.com/cve/CVE-2024-9384.htmlWed, 17 Jun 2026 08:24:27 +0000MEDIUM 6.1: The Quantity Dynamic Pricing & Bulk Discounts for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.8.0. This makes it possible for unauthenticated attackershttps://patchthecve.com/cve/CVE-2024-9189.htmlhttps://patchthecve.com/cve/CVE-2024-9189.htmlWed, 17 Jun 2026 08:24:06 +0000MEDIUM 5.3: The EU/UK VAT Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the alg_wc_eu_vat_exempt_vat_from_admin() function in all versions up to, and including, 2.12.12. This makes it possible for unauthenticated attackers tohttps://patchthecve.com/cve/CVE-2024-8788.htmlhttps://patchthecve.com/cve/CVE-2024-8788.htmlWed, 17 Jun 2026 08:23:18 +0000MEDIUM 6.1: The EU/UK VAT Manager for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.12.11. This makes it possible for unauthenticated attackers to inject arbitrary whttps://patchthecve.com/cve/CVE-2024-8656.htmlhttps://patchthecve.com/cve/CVE-2024-8656.htmlWed, 17 Jun 2026 08:23:03 +0000MEDIUM 6.1: The WPFactory Helper plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.7.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pageshttps://patchthecve.com/cve/CVE-2023-0062.htmlhttps://patchthecve.com/cve/CVE-2023-0062.htmlWed, 28 Oct 2026 19:10:00 +0000MEDIUM 5.4: The EAN for WooCommerce WordPress plugin before 4.4.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.