# cve.now: WP Swings The newest entries naming WP Swings as an affected vendor (up to 200), of 35 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md. - [CVE-2026-115431](https://cve.now/CVE-2026-115431.md): WordPress Upsell Order Bump Offer for WooCommerce plugin \<= 3.1.6 - Broken Access Control vulnerability (CVSS 7.1) - [CVE-2026-116409](https://cve.now/CVE-2026-116409.md): WordPress Upsell Order Bump Offer for WooCommerce plugin \<= 3.1.7 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1) - [CVE-2026-81799](https://cve.now/CVE-2026-81799.md): WordPress Return Refund and Exchange For WooCommerce plugin \<= 4.6.4 - Broken Access Control vulnerability (CVSS 7.5) - [CVE-2026-84760](https://cve.now/CVE-2026-84760.md): WordPress Ultimate Gift Cards For WooCommerce plugin \<= 3.2.9 - Broken Access Control vulnerability (CVSS 5.3) - [CVE-2026-81288](https://cve.now/CVE-2026-81288.md): WordPress Upsell Order Bump Offer for WooCommerce plugin \<= 3.1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1) - [CVE-2026-57709](https://cve.now/CVE-2026-57709.md): WordPress Membership For WooCommerce plugin \<= 3.1.0 - Arbitrary File Deletion vulnerability (CVSS 8.6) - [CVE-2026-57407](https://cve.now/CVE-2026-57407.md): WordPress PDF Generator for WordPress plugin \<= 1.6.2 - Server Side Request Forgery (SSRF) vulnerability (CVSS 7.2) - [CVE-2026-57400](https://cve.now/CVE-2026-57400.md): WordPress Event Tickets Manager for WooCommerce plugin \<= 1.5.5 - Broken Access Control vulnerability (CVSS 6.5) - [CVE-2026-57332](https://cve.now/CVE-2026-57332.md): WordPress Wallet System for WooCommerce plugin \<= 2.7.6 - Broken Access Control vulnerability (CVSS 7.1) - [CVE-2026-56061](https://cve.now/CVE-2026-56061.md): WordPress Subscriptions for WooCommerce plugin \<= 1.9.5 - Broken Access Control vulnerability (CVSS 7.5) - [CVE-2026-49110](https://cve.now/CVE-2026-49110.md): WordPress Upsell Order Bump Offer for WooCommerce plugin \<= 3.1.4 - Price Manipulation vulnerability (CVSS 7.5) - [CVE-2026-34898](https://cve.now/CVE-2026-34898.md): WordPress Event Tickets Manager for WooCommerce plugin \<= 1.5.3 - Broken Access Control vulnerability (CVSS 7.5) - [CVE-2026-42654](https://cve.now/CVE-2026-42654.md): WordPress Wallet System for WooCommerce plugin \<= 2.7.5 - Broken Authentication vulnerability (CVSS 7.1) - [CVE-2026-45444](https://cve.now/CVE-2026-45444.md): WordPress Gift Cards For WooCommerce Pro plugin \<= 4.2.6 - Arbitrary File Upload vulnerability (CVSS 10.0) - [CVE-2026-24372](https://cve.now/CVE-2026-24372.md): WordPress Subscriptions for WooCommerce plugin \<= 1.8.10 - Bypass Vulnerability vulnerability (CVSS 7.5) - [CVE-2026-24375](https://cve.now/CVE-2026-24375.md): WordPress Ultimate Gift Cards For WooCommerce plugin \<= 3.2.4 - Broken Access Control vulnerability (CVSS 5.3) - [CVE-2026-24581](https://cve.now/CVE-2026-24581.md): WordPress Points and Rewards for WooCommerce plugin \<= 2.9.5 - Broken Access Control vulnerability (CVSS 5.4) - [CVE-2025-68029](https://cve.now/CVE-2025-68029.md): WordPress Wallet System for WooCommerce plugin \<= 2.7.3 - Sensitive Data Exposure vulnerability (CVSS 6.3) - [CVE-2025-67909](https://cve.now/CVE-2025-67909.md): WordPress Membership For WooCommerce plugin \<= 3.0.3 - Insecure Direct Object References (IDOR) vulnerability (CVSS 7.5) - [CVE-2025-59565](https://cve.now/CVE-2025-59565.md): WordPress Upsell Order Bump Offer for WooCommerce Plugin \<= 3.0.7 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5) - [CVE-2025-58978](https://cve.now/CVE-2025-58978.md): WordPress PDF Generator for WordPress Plugin \<= 1.5.4 - Broken Access Control Vulnerability (CVSS 5.3) - [CVE-2025-54692](https://cve.now/CVE-2025-54692.md): WordPress Membership For WooCommerce Plugin \<= 2.9.0 - Broken Access Control Vulnerability (CVSS 7.5) - [CVE-2025-6222](https://cve.now/CVE-2025-6222.md): WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet \<= 3.2.6 - Unauthenticated Arbitrary File Upload (CVSS 9.8) - [CVE-2025-54041](https://cve.now/CVE-2025-54041.md): WordPress Wallet System for WooCommerce plugin \<= 2.6.7 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3) - [CVE-2025-49265](https://cve.now/CVE-2025-49265.md): WordPress Membership For WooCommerce plugin \<= 2.8.1 - Broken Access Control Vulnerability (CVSS 7.5) - [CVE-2025-32530](https://cve.now/CVE-2025-32530.md): WordPress Wallet System for WooCommerce plugin \<= 2.6.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1) - [CVE-2025-39579](https://cve.now/CVE-2025-39579.md): WordPress Membership For WooCommerce plugin \<= 2.8.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5) - [CVE-2024-8425](https://cve.now/CVE-2024-8425.md): WooCommerce Ultimate Gift Card \<= 2.9.2 - Unauthenticated Arbitrary File Upload (CVSS 9.8) - [CVE-2024-11423](https://cve.now/CVE-2024-11423.md): Ultimate Gift Cards for WooCommerce \<= 3.0.6 - Missing Authorization to Infinite Money Glitch (CVSS 7.5) - [CVE-2024-38699](https://cve.now/CVE-2024-38699.md): WordPress Wallet System for WooCommerce plugin \<= 2.5.13 - Sensitive Data Exposure via Exported File vulnerability (CVSS 7.5) - [CVE-2024-32446](https://cve.now/CVE-2024-32446.md): WordPress Wallet System for WooCommerce plugin \<= 2.5.9 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4) - [CVE-2023-27608](https://cve.now/CVE-2023-27608.md): WordPress Points and Rewards for WooCommerce plugin \<= 1.5.0 - Broken Access Control vulnerability (CVSS 6.5) - [CVE-2023-27607](https://cve.now/CVE-2023-27607.md): WordPress Points and Rewards for WooCommerce plugin \<= 1.5.0 - Settings Change vulnerability (CVSS 5.4) - [CVE-2024-25100](https://cve.now/CVE-2024-25100.md): WordPress Coupon Referral Program plugin \< 1.8.4 - Unauthenticated PHP Object Injection vulnerability (CVSS 10.0) - [CVE-2023-52190](https://cve.now/CVE-2023-52190.md): WordPress Coupon Referral Program Plugin \<= 1.7.2 is vulnerable to Sensitive Data Exposure (CVSS 7.5) --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/vendors/wp-swings Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.