Known Vulnerabilities for products from WPFactory
Listed below are 15 of the newest known vulnerabilities associated with the vendor "WPFactory".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2025-48254 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Change Add to... | Not Provided | 2025-05-19 | 2026-04-23 |
| CVE-2025-48253 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Free Shipping... | Not Provided | 2025-05-19 | 2026-04-23 |
| CVE-2025-48252 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Back Button W... | Not Provided | 2025-05-19 | 2026-04-23 |
| CVE-2024-44061 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory EU/UK VAT Man... | Not Provided | 2024-10-20 | 2026-04-23 |
| CVE-2024-13774 json | The Wishlist for WooCommerce: Multi Wishlists Per Customer plugin for WordPress is vulnerable to Cross-Site Request Forgery i... | Not Provided | 2025-03-08 | 2026-04-08 |
| CVE-2024-0821 json | The Cost of Goods Sold (COGS): Cost & Profit Calculator for WooCommerce plugin for WordPress is vulnerable to Reflected Cross... | Not Provided | 2024-02-29 | 2026-04-08 |
| CVE-2023-51399 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Back Button W... | Not Provided | 2023-12-29 | 2026-04-28 |
| CVE-2023-47547 json | ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new secur... | 6.1 - MEDIUM | 2023-11-14 | 2023-11-20 |
| CVE-2023-36689 json | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPFactory WPFactory Helper plugin <= 1.5.2 versions. | 6.1 - MEDIUM | 2023-08-05 | 2023-08-09 |
| CVE-2023-6897 json | The EAN for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and inc... | Not Provided | 2024-04-18 | 2026-04-08 |
| CVE-2023-6892 json | The EAN for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'alg_wc_ean_produc... | Not Provided | 2024-04-18 | 2026-04-08 |
| CVE-2023-2684 json | The File Renaming on Upload WordPress plugin before 2.5.2 does not sanitise and escape some of its settings, which could allo... | 4.8 - MEDIUM | 2023-06-19 | 2023-11-07 |
| CVE-2023-0062 json | The EAN for WooCommerce WordPress plugin before 4.4.3 does not validate and escape some of its shortcode attributes before ou... | 5.4 - MEDIUM | 2023-02-06 | 2023-11-07 |
| CVE-2021-4418 json | The Custom CSS, JS & PHP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2... | Not Provided | 2023-10-20 | 2026-04-08 |
| CVE-2019-17239 json | includes/settings/class-alg-download-plugins-settings.php in the download-plugins-dashboard plugin through 1.5.0 for WordPres... | 6.1 - MEDIUM | 2019-10-07 | 2019-10-11 |
Known software with vulnerabilities from WPFactory
| Type | Vendor | Product | Version |
|---|---|---|---|
| Application | Wpfactory | Download Plugins And Themes From Dashboard | - |