Wpweb vulnerabilities
26 CVEs and advisories name Wpweb as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-8457WooCommerce - Social Login <= 2.8.7 - Unauthenticated Authentication Bypass via Forged Apple 'id_token' JWT
- CVE-2025-68547WordPress Follow My Blog Post plugin <= 2.4.0 - Arbitrary Content Deletion vulnerability
- CVE-2025-64258WordPress Follow My Blog Post plugin <= 2.3.9 - Sensitive Data Exposure vulnerability
- CVE-2025-39472WordPress WooCommerce Social Login plugin < 2.8.3 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-56265WordPress WooCommerce - PDF Vouchers plugin < 4.9.9 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-54383WordPress WooCommerce - PDF Vouchers plugin < 4.9.9 - Broken Authentication vulnerability
- CVE-2024-10114Social Login - WordPress / WooCommerce Plugin <= 2.7.7 - Authentication Bypass via WordPress.com OAuth provider
- CVE-2024-49272WordPress Social Auto Poster plugin <= 5.3.15 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-47369WordPress Social Auto Poster plugin <= 5.3.15 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2024-43131WordPress Docket (WooCommerce Collections / Wishlist / Watchlist) plugin < 1.7.0 - Unauthenticated Arbitrary Post/Page Deletion vulnerability
- CVE-2024-39651WordPress WooCommerce PDF Vouchers plugin < 4.9.5 - Unauthenticated Arbitrary File Deletion vulnerability
- CVE-2024-7503WooCommerce - Social Login <= 2.7.5 - Authentication Bypass to Account Takeover
- CVE-2024-6755Social Auto Poster <= 5.3.14 - Missing Authorization to Unauthenticated Arbitrary Post Deletion
- CVE-2024-6751Social Auto Poster <= 5.3.14 - Cross-Site Request Forgery via Multiple Functions
- CVE-2024-7027WooCommerce - PDF Vouchers <= 4.9.3 - Authentication Bypass to Voucher Vendor
- CVE-2024-6754Social Auto Poster <= 5.3.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Update via wpw_auto_poster_update_tweet_template
- CVE-2024-6753Social Auto Poster <= 5.3.14 - Unauthenticated Stored Cross-Site Scripting
- CVE-2024-6752Social Auto Poster <= 5.3.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- CVE-2024-6750Social Auto Poster <= 5.3.14 - Missing Authorization via Multiple Functions
- CVE-2024-6756Social Auto Poster <= 5.3.14 - Authenticated (Contributor+) Arbitrary File Upload
- CVE-2024-6636WooCommerce - Social Login <= 2.7.3 - Missing Authorization to Unauthenticated Privilege Escalation
- CVE-2024-6635WooCommerce - Social Login <= 2.7.3 - Unauthenticated Authentication Bypass
- CVE-2024-6637WooCommerce - Social Login <= 2.7.3 - Unauthenticated Privilege Escalation via One-Time Password
- CVE-2024-37502WordPress Social Login plugin <= 2.6.3 - PHP Object Injection vulnerability
- CVE-2024-5871WooCommerce - Social Login <= 2.6.2 - Unauthenticated PHP Object Injection
- CVE-2024-5868WooCommerce - Social Login <= 2.6.2 - Email Verification due to Insufficient Randomness