# cve.now: Premmerce

The newest entries naming Premmerce as an affected vendor (up to 200), of 31 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-97273](https://cve.now/CVE-2026-97273.md): WordPress Premmerce Wishlist for WooCommerce plugin \<= 1.1.13 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-97268](https://cve.now/CVE-2026-97268.md): WordPress Premmerce Wishlist for WooCommerce plugin \<= 1.1.13 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-97272](https://cve.now/CVE-2026-97272.md): WordPress Premmerce Permalink Manager for WooCommerce plugin \<= 2.3.13 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-54849](https://cve.now/CVE-2026-54849.md): WordPress Premmerce Wishlist for WooCommerce plugin \<= 1.1.11 - SQL Injection vulnerability (CVSS 9.3)
- [CVE-2026-6933](https://cve.now/CVE-2026-6933.md): Premmerce Dev Tools \<= 2.0 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via Plugin Creation (CVSS 8.8)
- [CVE-2024-13362](https://cve.now/CVE-2024-13362.md): Freemius \<= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter (CVSS 6.1)
- [CVE-2026-32541](https://cve.now/CVE-2026-32541.md): WordPress Premmerce Redirect Manager plugin \<= 1.0.12 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-0555](https://cve.now/CVE-2026-0555.md): Premmerce \<= 1.3.20 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'premmerce\_wizard\_actions' AJAX Endpoint (CVSS 6.4)
- [CVE-2025-13369](https://cve.now/CVE-2025-13369.md): Premmerce WooCommerce Customers Manager \<= 1.1.14 - Reflected Cross-Site Scripting (CVSS 6.1)
- [CVE-2025-13440](https://cve.now/CVE-2025-13440.md): Premmerce Wishlist for WooCommerce \<= 1.1.10 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Wishlist Deletion (CVSS 5.3)
- [CVE-2025-12783](https://cve.now/CVE-2025-12783.md): Premmerce Brands for WooCommerce \<= 1.2.13 - Missing Authorization To Authenticated (Subscriber+) Brand Permalink Settings Update (CVSS 4.3)
- [CVE-2025-12411](https://cve.now/CVE-2025-12411.md): Premmerce Wholesale Pricing for WooCommerce \<= 1.1.10 - Authenticated (Subscriber+) SQL Injection (CVSS 7.1)
- [CVE-2025-60241](https://cve.now/CVE-2025-60241.md): WordPress Premmerce plugin \<= 1.3.19 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2025-60194](https://cve.now/CVE-2025-60194.md): WordPress Premmerce Product Search for WooCommerce plugin \<= 2.2.4 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2025-60193](https://cve.now/CVE-2025-60193.md): WordPress Premmerce User Roles plugin \<= 1.0.13 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2025-60192](https://cve.now/CVE-2025-60192.md): WordPress Premmerce Wholesale Pricing for WooCommerce plugin \<= 1.1.10 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2025-60191](https://cve.now/CVE-2025-60191.md): WordPress Premmerce Wishlist for WooCommerce plugin \<= 1.1.10 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2025-64291](https://cve.now/CVE-2025-64291.md): WordPress Premmerce User Roles plugin \<= 1.0.13 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2025-64290](https://cve.now/CVE-2025-64290.md): WordPress Premmerce Product Search for WooCommerce plugin \<= 2.2.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2025-64289](https://cve.now/CVE-2025-64289.md): WordPress Premmerce Product Search for WooCommerce plugin \<= 2.2.7 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2025-64288](https://cve.now/CVE-2025-64288.md): WordPress Premmerce plugin \<= 1.3.19 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2025-64285](https://cve.now/CVE-2025-64285.md): WordPress Premmerce Wholesale Pricing for WooCommerce plugin \<= 1.1.10 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2025-62890](https://cve.now/CVE-2025-62890.md): WordPress Premmerce Brands for WooCommerce plugin \<= 1.2.13 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2025-62883](https://cve.now/CVE-2025-62883.md): WordPress Premmerce User Roles plugin \<= 1.0.13 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2023-41130](https://cve.now/CVE-2023-41130.md): WordPress Premmerce User Roles plugin \<= 1.0.12 - Broken Access Control vulnerability (CVSS 8.1)
- [CVE-2022-4974](https://cve.now/CVE-2022-4974.md): Freemius SDK \<= 2.4.2 - Missing Authorization Checks (CVSS 6.3)
- [CVE-2024-31359](https://cve.now/CVE-2024-31359.md): WordPress Premmerce Product Filter for WooCommerce plugin \<= 3.7.2 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-27971](https://cve.now/CVE-2024-27971.md): WordPress Premmerce Permalink Manager for WooCommerce plugin \<= 2.3.10 - Local File Inclusion vulnerability (CVSS 8.3)
- [CVE-2023-23719](https://cve.now/CVE-2023-23719.md): WordPress Premmerce Plugin \<= 1.3.17 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4)
- [CVE-2023-23787](https://cve.now/CVE-2023-23787.md): WordPress Premmerce Redirect Manager Plugin \<= 1.0.9 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3)
- [CVE-2023-23789](https://cve.now/CVE-2023-23789.md): WordPress Premmerce Redirect Manager Plugin \<= 1.0.9 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/premmerce
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.