# cve.now: Wpclever

The newest entries naming Wpclever as an affected vendor (up to 200), of 39 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-104313](https://cve.now/CVE-2026-104313.md): WPC Estimated Delivery Date for WooCommerce \<= 4.0.1 - Reflected Cross-Site Scripting via 'rule\_data' Parameter (CVSS 6.1)
- [CVE-2026-97660](https://cve.now/CVE-2026-97660.md): WPC Product Options for WooCommerce \<= 4.0.5 - Unauthenticated Stored Cross-Site Scripting via wpcpo-\* Array Key via Multipart Field Name (CVSS 7.2)
- [CVE-2026-103888](https://cve.now/CVE-2026-103888.md): WPC Smart Quick View for WooCommerce \<= 4.4.0 - Reflected Cross-Site Scripting via 'woosq-redirect' Parameter (CVSS 6.1)
- [CVE-2026-95687](https://cve.now/CVE-2026-95687.md): WPC Shop as a Customer for WooCommerce \<= 2.0.0 - Authenticated (Subscriber+) Privilege Escalation via Missing Role Check on Target User to wpcsa\_login AJAX Endpoint (CVSS 8.8)
- [CVE-2026-93836](https://cve.now/CVE-2026-93836.md): WPC Product Bundles for WooCommerce \<= 8.6.6 - Unauthenticated Stored Cross-Site Scripting via 'qty' Parameter (CVSS 7.2)
- [CVE-2026-7436](https://cve.now/CVE-2026-7436.md): WPC Badge Management for WooCommerce \<= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Attribute (CVSS 6.4)
- [CVE-2026-49061](https://cve.now/CVE-2026-49061.md): WordPress WPC Product Options for WooCommerce plugin \<= 3.2.1 - Arbitrary File Download vulnerability (CVSS 7.5)
- [CVE-2026-48883](https://cve.now/CVE-2026-48883.md): WordPress WPC Product Bundles for WooCommerce plugin \<= 8.5.3 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2025-14767](https://cve.now/CVE-2025-14767.md): WPC Badge Management for WooCommerce \<= 3.1.6 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'text' Attribute (CVSS 5.5)
- [CVE-2026-6725](https://cve.now/CVE-2026-6725.md): WPC Smart Messages for WooCommerce \<= 4.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attribute (CVSS 6.4)
- [CVE-2026-32407](https://cve.now/CVE-2026-32407.md): WordPress WPC Smart Wishlist for WooCommerce plugin \<= 5.0.8 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-32406](https://cve.now/CVE-2026-32406.md): WordPress WPC Product Bundles for WooCommerce plugin \<= 8.4.5 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2025-60248](https://cve.now/CVE-2025-60248.md): WordPress WPC Product Options for WooCommerce plugin \<= 3.1.3 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2025-12115](https://cve.now/CVE-2025-12115.md): WPC Name Your Price for WooCommerce \<= 2.1.9 - Unauthenticated Price Alteration (CVSS 7.5)
- [CVE-2025-62903](https://cve.now/CVE-2025-62903.md): WordPress WPC Smart Messages for WooCommerce plugin \<= 4.2.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-49908](https://cve.now/CVE-2025-49908.md): WordPress WPC Countdown Timer for WooCommerce plugin \<= 3.1.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-11741](https://cve.now/CVE-2025-11741.md): WPC Smart Quick View for WooCommerce \<= 4.2.5 - Insecure Direct Object Reference to Unauthenticated Private Product Exposure (CVSS 5.3)
- [CVE-2025-11742](https://cve.now/CVE-2025-11742.md): WPC Smart Wishlist for WooCommerce \<= 5.0.4 - Missing Authorization to Authenticated (Subscriber+) Information Exposure (CVSS 4.3)
- [CVE-2025-11518](https://cve.now/CVE-2025-11518.md): WPC Smart Wishlist for WooCommerce \<= 5.0.3 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation (CVSS 5.3)
- [CVE-2025-8618](https://cve.now/CVE-2025-8618.md): WPC Smart Quick View for WooCommerce \<= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via woosq\_btn Shortcode (CVSS 6.4)
- [CVE-2025-7496](https://cve.now/CVE-2025-7496.md): WPC Smart Compare for WooCommerce \<= 6.4.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2025-5530](https://cve.now/CVE-2025-5530.md): WPC Smart Compare for WooCommerce \<= 6.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2025-3418](https://cve.now/CVE-2025-3418.md): WPC Admin Columns 2.0.6 - 2.1.0 - Authenticated (Subscriber+) Privilege Escalation via User Meta Update (CVSS 8.8)
- [CVE-2025-30825](https://cve.now/CVE-2025-30825.md): WordPress WPC Smart Linked Products plugin \<= 1.3.5 - Privilege Escalation vulnerability (CVSS 8.8)
- [CVE-2025-30772](https://cve.now/CVE-2025-30772.md): WordPress WPC Smart Upsell Funnel for WooCommerce plugin \<= 3.0.4 - Arbitrary Option Update to Privilege Escalation vulnerability (CVSS 8.8)
- [CVE-2024-12432](https://cve.now/CVE-2024-12432.md): WPC Shop as a Customer for WooCommerce \<= 1.2.8 - Authentication Bypass Due to Insufficiently Unique Key (CVSS 8.1)
- [CVE-2024-12004](https://cve.now/CVE-2024-12004.md): WPC Order Notes for WooCommerce \<= 1.5.2 - Cross-Site Request Forgery to Reflected Cross-Site Scripting (CVSS 6.1)
- [CVE-2024-5020](https://cve.now/CVE-2024-5020.md): Multiple Plugins \<= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library (CVSS 6.4)
- [CVE-2024-43312](https://cve.now/CVE-2024-43312.md): WordPress WPC Frequently Bought Together for WooCommerce plugin \<= 7.1.9 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2024-10437](https://cve.now/CVE-2024-10437.md): WPC Smart Messages for WooCommerce \<= 4.2.1 - Missing Authorization to Authenticated (Subscriber+) Message Activation/Deactivation (CVSS 4.3)
- [CVE-2024-10436](https://cve.now/CVE-2024-10436.md): WPC Smart Messages for WooCommerce \<= 4.2.1 - Authenticated (Subscriber+) Local File Inclusion (CVSS 8.8)
- [CVE-2024-50416](https://cve.now/CVE-2024-50416.md): WordPress WPC Shop as a Customer for WooCommerce plugin \<= 1.2.6 - PHP Object Injection vulnerability (CVSS 8.8)
- [CVE-2024-30537](https://cve.now/CVE-2024-30537.md): WordPress WPC Badge Management for WooCommerce plugin \<= 2.4.0 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-2838](https://cve.now/CVE-2024-2838.md): WPC Composite Products for WooCommerce \<= 7.2.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-32687](https://cve.now/CVE-2024-32687.md): WordPress WPC Frequently Bought Together for WooCommerce plugin \<= 7.0.3 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-32520](https://cve.now/CVE-2024-32520.md): WordPress WPC Grouped Product for WooCommerce plugin \<= 4.4.2 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2023-6494](https://cve.now/CVE-2023-6494.md): WPC Smart Quick View for WooCommerce \<= 4.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4)
- [CVE-2023-52127](https://cve.now/CVE-2023-52127.md): WordPress WPC Product Bundles for WooCommerce Plugin \<= 7.3.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3)
- [CVE-2023-34386](https://cve.now/CVE-2023-34386.md): WordPress WPC Smart Wishlist for WooCommerce Plugin \<= 4.7.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/wpclever
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.