# cve.now: Wpweb

The newest entries naming Wpweb as an affected vendor (up to 200), of 26 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-8457](https://cve.now/CVE-2026-8457.md): WooCommerce - Social Login \<= 2.8.7 - Unauthenticated Authentication Bypass via Forged Apple 'id\_token' JWT (CVSS 9.8)
- [CVE-2025-68547](https://cve.now/CVE-2025-68547.md): WordPress Follow My Blog Post plugin \<= 2.4.0 - Arbitrary Content Deletion vulnerability (CVSS 7.5)
- [CVE-2025-64258](https://cve.now/CVE-2025-64258.md): WordPress Follow My Blog Post plugin \<= 2.3.9 - Sensitive Data Exposure vulnerability (CVSS 7.5)
- [CVE-2025-39472](https://cve.now/CVE-2025-39472.md): WordPress WooCommerce Social Login plugin \< 2.8.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2024-56265](https://cve.now/CVE-2024-56265.md): WordPress WooCommerce - PDF Vouchers plugin \< 4.9.9 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2024-54383](https://cve.now/CVE-2024-54383.md): WordPress WooCommerce - PDF Vouchers plugin \< 4.9.9 - Broken Authentication vulnerability (CVSS 9.8)
- [CVE-2024-10114](https://cve.now/CVE-2024-10114.md): Social Login - WordPress / WooCommerce Plugin \<= 2.7.7 - Authentication Bypass via WordPress.com OAuth provider (CVSS 8.1)
- [CVE-2024-49272](https://cve.now/CVE-2024-49272.md): WordPress Social Auto Poster plugin \<= 5.3.15 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2024-47369](https://cve.now/CVE-2024-47369.md): WordPress Social Auto Poster plugin \<= 5.3.15 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2024-43131](https://cve.now/CVE-2024-43131.md): WordPress Docket (WooCommerce Collections / Wishlist / Watchlist) plugin \< 1.7.0 - Unauthenticated Arbitrary Post/Page Deletion vulnerability (CVSS 7.5)
- [CVE-2024-39651](https://cve.now/CVE-2024-39651.md): WordPress WooCommerce PDF Vouchers plugin \< 4.9.5 - Unauthenticated Arbitrary File Deletion vulnerability (CVSS 8.6)
- [CVE-2024-7503](https://cve.now/CVE-2024-7503.md): WooCommerce - Social Login \<= 2.7.5 - Authentication Bypass to Account Takeover (CVSS 9.8)
- [CVE-2024-6755](https://cve.now/CVE-2024-6755.md): Social Auto Poster \<= 5.3.14 - Missing Authorization to Unauthenticated Arbitrary Post Deletion (CVSS 6.5)
- [CVE-2024-6751](https://cve.now/CVE-2024-6751.md): Social Auto Poster \<= 5.3.14 - Cross-Site Request Forgery via Multiple Functions (CVSS 6.3)
- [CVE-2024-7027](https://cve.now/CVE-2024-7027.md): WooCommerce - PDF Vouchers \<= 4.9.3 - Authentication Bypass to Voucher Vendor (CVSS 7.3)
- [CVE-2024-6754](https://cve.now/CVE-2024-6754.md): Social Auto Poster \<= 5.3.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Update via wpw\_auto\_poster\_update\_tweet\_template (CVSS 5.4)
- [CVE-2024-6753](https://cve.now/CVE-2024-6753.md): Social Auto Poster \<= 5.3.14 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2)
- [CVE-2024-6752](https://cve.now/CVE-2024-6752.md): Social Auto Poster \<= 5.3.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-6750](https://cve.now/CVE-2024-6750.md): Social Auto Poster \<= 5.3.14 - Missing Authorization via Multiple Functions (CVSS 7.3)
- [CVE-2024-6756](https://cve.now/CVE-2024-6756.md): Social Auto Poster \<= 5.3.14 - Authenticated (Contributor+) Arbitrary File Upload (CVSS 8.8)
- [CVE-2024-6636](https://cve.now/CVE-2024-6636.md): WooCommerce - Social Login \<= 2.7.3 - Missing Authorization to Unauthenticated Privilege Escalation (CVSS 9.8)
- [CVE-2024-6635](https://cve.now/CVE-2024-6635.md): WooCommerce - Social Login \<= 2.7.3 - Unauthenticated Authentication Bypass (CVSS 7.3)
- [CVE-2024-6637](https://cve.now/CVE-2024-6637.md): WooCommerce - Social Login \<= 2.7.3 - Unauthenticated Privilege Escalation via One-Time Password (CVSS 7.3)
- [CVE-2024-37502](https://cve.now/CVE-2024-37502.md): WordPress Social Login plugin \<= 2.6.3 - PHP Object Injection vulnerability (CVSS 5.4)
- [CVE-2024-5871](https://cve.now/CVE-2024-5871.md): WooCommerce - Social Login \<= 2.6.2 - Unauthenticated PHP Object Injection (CVSS 9.8)
- [CVE-2024-5868](https://cve.now/CVE-2024-5868.md): WooCommerce - Social Login \<= 2.6.2 - Email Verification due to Insufficient Randomness (CVSS 6.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/wpweb
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.