FantasticPlugins vulnerabilities
We track 8 vulnerabilities in FantasticPlugins products across 5 products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on July 23, 2026.
Latest FantasticPlugins vulnerabilities
- 7.2 High severity
SUMO Reward Points for WooCommerce: Improper Neutralization of Input During Web Page Generation
The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REST API endpoint `/wp-json/wc-srp/v1/earning` in versions up to, and including, 32.7.0. This is due to the `user_has_cap` filter in the `SRP_REST_
- 9.8 Critical severity
SUMO Affiliates Pro: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in FantasticPlugins SUMO Affiliates Pro affs allows Object Injection.This issue affects SUMO Affiliates Pro: from n/a through < 11.4.0.
- 7.5 High severity
WooCommerce Recover Abandoned Cart: Missing Authorization
Missing Authorization vulnerability in FantasticPlugins WooCommerce Recover Abandoned Cart rac allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Recover Abandoned Cart: from n/a through <= 24.6.0.
- 7.1 High severity
SUMO Memberships for WooCommerce: Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in FantasticPlugins SUMO Memberships for WooCommerce sumomemberships allows Cross Site Request Forgery.This issue affects SUMO Memberships for WooCommerce: from n/a through < 7.8.0.
- 8.8 High severity
SUMO Memberships for WooCommerce: Incorrect Privilege Assignment
Incorrect Privilege Assignment vulnerability in FantasticPlugins SUMO Memberships for WooCommerce sumomemberships allows Privilege Escalation.This issue affects SUMO Memberships for WooCommerce: from n/a through <= 7.8.0.
- 10.0 Critical severity
SUMO Affiliates Pro: Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type vulnerability in FantasticPlugins SUMO Affiliates Pro affs allows Using Malicious Files.This issue affects SUMO Affiliates Pro: from n/a through < 11.1.0.
- 9.8 Critical severity
SUMO Reward Points: Improper Control of Filename for Include/Require Statement in PHP Program
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in FantasticPlugins SUMO Reward Points rewardsystem allows PHP Local File Inclusion.This issue affects SUMO Reward Points: from n/a through <=
- 8.1 High severity
WooCommerce Recover Abandoned Cart: Deserialization of Untrusted Data
The WooCommerce Recover Abandoned Cart plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 24.4.0 via deserialization of untrusted input from the 'raccookie_guest_email' cookie. This makes it possible for unauthenti