# cve.now: Wpfactory

The newest entries naming Wpfactory as an affected vendor (up to 200), of 51 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-112866](https://cve.now/CVE-2026-112866.md): WordPress Product Filter by WBW plugin \<= 3.4.6 - SQL Injection vulnerability (CVSS 9.3)
- [CVE-2026-93771](https://cve.now/CVE-2026-93771.md): WordPress Cost of Goods for WooCommerce plugin \<= 3.5.2 - PHP Object Injection vulnerability (CVSS 7.2)
- [CVE-2026-39437](https://cve.now/CVE-2026-39437.md): WordPress Min Max Step Quantity Limits Manager for WooCommerce plugin \<= 5.2.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-24993](https://cve.now/CVE-2026-24993.md): WordPress Advanced WooCommerce Product Sales Reporting plugin \<= 4.1.3 - SQL Injection vulnerability (CVSS 9.3)
- [CVE-2026-23977](https://cve.now/CVE-2026-23977.md): WordPress Helpdesk Support Ticket System for WooCommerce plugin \<= 2.1.2 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2026-24992](https://cve.now/CVE-2026-24992.md): WordPress Advanced WooCommerce Product Sales Reporting plugin \<= 4.1.2 - Sensitive Data Exposure vulnerability (CVSS 5.3)
- [CVE-2025-69334](https://cve.now/CVE-2025-69334.md): WordPress Wishlist for WooCommerce plugin \<= 3.3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-62096](https://cve.now/CVE-2025-62096.md): WordPress Maximum Products per User for WooCommerce plugin \<= 4.4.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-68528](https://cve.now/CVE-2025-68528.md): WordPress Free Shipping Bar: Amount Left for Free Shipping for WooCommerce plugin \<= 2.4.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-57911](https://cve.now/CVE-2025-57911.md): WordPress Adverts Plugin \<= 1.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-57972](https://cve.now/CVE-2025-57972.md): WordPress Helpdesk Support Ticket System for WooCommerce plugin \<= 2.1.1 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2025-58985](https://cve.now/CVE-2025-58985.md): WordPress Additional Custom Product Tabs for WooCommerce Plugin \<= 1.7.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-49887](https://cve.now/CVE-2025-49887.md): WordPress Product XML Feed Manager for WooCommerce Plugin \<= 2.9.3 - Remote Code Execution (RCE) Vulnerability (CVSS 9.9)
- [CVE-2025-30959](https://cve.now/CVE-2025-30959.md): WordPress Product XML Feed Manager for WooCommerce \<= 2.9.2 - Broken Access Control Vulnerability (CVSS 6.5)
- [CVE-2025-49319](https://cve.now/CVE-2025-49319.md): WordPress Wishlist for WooCommerce \<= 3.2.3 - Broken Access Control Vulnerability (CVSS 6.5)
- [CVE-2025-49987](https://cve.now/CVE-2025-49987.md): WordPress CRM ERP Business Solution plugin \<= 1.13 - Broken Access Control Vulnerability (CVSS 5.3)
- [CVE-2025-49510](https://cve.now/CVE-2025-49510.md): WordPress Min Max Step Quantity Limits Manager for WooCommerce plugin \<= 5.1.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2025-48254](https://cve.now/CVE-2025-48254.md): WordPress Change Add to Cart Button Text for WooCommerce plugin \<= 2.2.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-48253](https://cve.now/CVE-2025-48253.md): WordPress Free Shipping Bar: Amount Left for Free Shipping for WooCommerce plugin \<= 2.4.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-48252](https://cve.now/CVE-2025-48252.md): WordPress Back Button Widget plugin \<= 1.6.8 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-48251](https://cve.now/CVE-2025-48251.md): WordPress Additional Custom Emails & Recipients for WooCommerce plugin \<= 3.5.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-48250](https://cve.now/CVE-2025-48250.md): WordPress Coupons & Add to Cart by URL Links for WooCommerce plugin \<= 1.7.7 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-48249](https://cve.now/CVE-2025-48249.md): WordPress EAN for WooCommerce plugin \<= 5.4.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-48248](https://cve.now/CVE-2025-48248.md): WordPress Sitewide Discount for WooCommerce: Apply Discount to All Products plugin \<= 2.2.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-48240](https://cve.now/CVE-2025-48240.md): WordPress Cost of Goods for WooCommerce plugin \<= 3.7.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-48239](https://cve.now/CVE-2025-48239.md): WordPress Product Notes Tab & Private Admin Notes for WooCommerce plugin \<= 3.1.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-48237](https://cve.now/CVE-2025-48237.md): WordPress Wishlist for WooCommerce plugin \<= 3.2.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-47504](https://cve.now/CVE-2025-47504.md): WordPress Custom Checkout Fields for WooCommerce plugin \<= 1.8.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-32552](https://cve.now/CVE-2025-32552.md): WordPress MSRP (RRP) Pricing for WooCommerce Plugin \<= 1.8.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-32674](https://cve.now/CVE-2025-32674.md): WordPress Product Excel Import Export & Bulk Edit for WooCommerce plugin \<= 4.7 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1)
- [CVE-2025-39601](https://cve.now/CVE-2025-39601.md): WordPress Custom CSS, JS & PHP plugin \<= 2.4.1 - CSRF to RCE vulnerability (CVSS 9.6)
- [CVE-2025-26749](https://cve.now/CVE-2025-26749.md): WordPress Additional Custom Product Tabs for WooCommerce plugin \<= 1.7.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-31553](https://cve.now/CVE-2025-31553.md): WordPress Advanced WooCommerce Product Sales Reporting plugin \<= 4.1.1 - SQL Injection vulnerability (CVSS 9.3)
- [CVE-2025-31848](https://cve.now/CVE-2025-31848.md): WordPress WordPress Adverts Plugin plugin \<= 1.4 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2025-31598](https://cve.now/CVE-2025-31598.md): WordPress Quantity Dynamic Pricing & Bulk Discounts for WooCommerce plugin \<= 4.0.3 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-22673](https://cve.now/CVE-2025-22673.md): WordPress EAN Barcode Generator \<= 5.3.5 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2025-30781](https://cve.now/CVE-2025-30781.md): WordPress Scheduled & Automatic Order Status Controller for WooCommerce plugin \<= 3.7.1 - Open Redirection Vulnerability (CVSS 4.7)
- [CVE-2024-56228](https://cve.now/CVE-2024-56228.md): WordPress Wishlist for WooCommerce: Multi Wishlists Per Customer plugin \<= 3.1.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2024-54332](https://cve.now/CVE-2024-54332.md): WordPress WP Currency Exchange Rates plugin \<= 1.2.0 - CSRF to Stored XSS vulnerability (CVSS 7.1)
- [CVE-2023-23868](https://cve.now/CVE-2023-23868.md): WordPress Cost of Goods for WooCommerce plugin \<= 2.8.6 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2024-54209](https://cve.now/CVE-2024-54209.md): WordPress Awesome Shortcodes plugin \<= 1.7.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2024-44061](https://cve.now/CVE-2024-44061.md): WordPress EU/UK VAT Manager for WooCommerce plugin \<= 2.12.14 - CSRF to Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2024-49305](https://cve.now/CVE-2024-49305.md): WordPress Customer Email Verification for WooCommerce plugin \<= 2.8.10 - SQL Injection vulnerability (CVSS 9.3)
- [CVE-2024-43127](https://cve.now/CVE-2024-43127.md): WordPress Products, Order & Customers Export for WooCommerce plugin \<= 2.0.11 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2024-31276](https://cve.now/CVE-2024-31276.md): WordPress Products, Order & Customers Export for WooCommerce plugin \<= 2.0.8 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2024-35162](https://cve.now/CVE-2024-35162.md): Path traversal vulnerability exists in Download Plugins and Themes from Dashboard versions prior to 1.8.6. (CVSS 6.5)
- [CVE-2024-34370](https://cve.now/CVE-2024-34370.md): WordPress EAN for WooCommerce plugin \<= 4.8.9 - Arbitrary Option Update to Privilege Escalation vulnerability (CVSS 7.2)
- [CVE-2024-30536](https://cve.now/CVE-2024-30536.md): WordPress Slugs Manager plugin \<= 2.6.7 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2023-51399](https://cve.now/CVE-2023-51399.md): WordPress Back Button Widget Plugin \<= 1.6.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5)
- [CVE-2023-47547](https://cve.now/CVE-2023-47547.md): WordPress Products, Order & Customers Export for WooCommerce Plugin \<= 2.0.7 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1)
- [CVE-2023-36689](https://cve.now/CVE-2023-36689.md): WordPress WPFactory Helper Plugin \<= 1.5.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/wpfactory
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.