Addify vulnerabilities
We track 4 vulnerabilities in Addify products across 3 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on September 26, 2026.
Latest Addify vulnerabilities
- 9.8 Critical severity
Request a Quote for WooCommerce: Unrestricted Upload of File with Dangerous Type
The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.9.2 via the `afrfq_submit_quote_via_popup()` function. This is due to missing file extension and MIME type validation in the
- 9.8 Critical severity
Custom User Registration Fields for WooCommerce: Improper Privilege Management
The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.3. This is due to the plugin accepting an attacker-controlled afreg_select_user_role value from the unauthentic
- 10.0 Critical severity
Custom User Registration Fields for WooCommerce: Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type vulnerability in Addify Custom User Registration Fields for WooCommerce user-registration-plugin-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects Custom User Registration Fields for Wo
- 9.8 Critical severity
Free Gifts: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in addify Addifyfreegifts v.1.0.2 and before allows a remote attacker to execute arbitrary code via a crafted script to the getrulebyid function in the AddifyfreegiftsModel.php component.