WP Swings vulnerabilities
We track 19 vulnerabilities in WP Swings products across 11 products. 19 are rated high or critical, and none are known to be exploited. The most recent was published on November 6, 2026.
Latest WP Swings vulnerabilities
- 7.1 High severity
Upsell Order Bump Offer for WooCommerce: Missing Authorization
Missing Authorization vulnerability in WP Swings Upsell Order Bump Offer for WooCommerce upsell-order-bump-offer-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Upsell Order Bump Offer for WooCommerce:
- 7.1 High severity
Upsell Order Bump Offer for WooCommerce: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Swings Upsell Order Bump Offer for WooCommerce upsell-order-bump-offer-for-woocommerce allows Reflected XSS.This issue affects Upsell Order Bump Offer for
- 7.5 High severity
Return Refund and Exchange For WooCommerce: Missing Authorization
Missing Authorization vulnerability in WP Swings Return Refund and Exchange For WooCommerce woo-refund-and-exchange-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Return Refund and Exchange For WooCommerce: from
- 8.6 High severity
Membership For WooCommerce: Improper Limitation of a Pathname to a Restricted Directory
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP Swings Membership For WooCommerce membership-for-woocommerce allows Path Traversal.This issue affects Membership For WooCommerce: from n/a through <= 3.1.0.
- 7.2 High severity
PDF Generator for WordPress: Server-Side Request Forgery
Server-Side Request Forgery (SSRF) vulnerability in WP Swings PDF Generator for WordPress pdf-generator-for-wp allows Server Side Request Forgery.This issue affects PDF Generator for WordPress: from n/a through <= 1.6.2.
- 7.1 High severity
Wallet System for WooCommerce: Authentication Bypass Using an Alternate Path or Channel
Authentication Bypass Using an Alternate Path or Channel vulnerability in WP Swings Wallet System for WooCommerce allows Password Recovery Exploitation. This issue affects Wallet System for WooCommerce: from n/a through 2.7.5.
- 10.0 Critical severity
Gift Cards For WooCommerce Pro: Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type vulnerability in WP Swings Gift Cards For WooCommerce Pro allows Using Malicious Files. This issue affects Gift Cards For WooCommerce Pro: from n/a through 4.2.6.
- 7.5 High severity
Subscriptions for WooCommerce: Authentication Bypass by Spoofing
Authentication Bypass by Spoofing vulnerability in WP Swings Subscriptions for WooCommerce subscriptions-for-woocommerce allows Input Data Manipulation.This issue affects Subscriptions for WooCommerce: from n/a through <= 1.8.10.
- 7.5 High severity
Membership For WooCommerce: Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key vulnerability in WP Swings Membership For WooCommerce membership-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Membership For WooCommerce: from n/a th
- 7.5 High severity
Membership For WooCommerce: Missing Authorization
Missing Authorization vulnerability in WP Swings Membership For WooCommerce membership-for-woocommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Membership For WooCommerce: from n/a through <= 2.9.0.
- 9.8 Critical severity
WooCommerce Refund And Exchange with RMA -…: Unrestricted Upload of File with Dangerous Type
The WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'ced_rnx_order_exchange_attach_files' function in all v
- 7.5 High severity
Membership For WooCommerce: Missing Authorization
Missing Authorization vulnerability in WP Swings Membership For WooCommerce membership-for-woocommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Membership For WooCommerce: from n/a through <= 2.8.1.
- 7.1 High severity
Wallet System for WooCommerce: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Swings Wallet System for WooCommerce wallet-system-for-woocommerce allows Reflected XSS.This issue affects Wallet System for WooCommerce: from n/a through
- 9.8 Critical severity
WooCommerce Ultimate Gift Card: Unrestricted Upload of File with Dangerous Type
The WooCommerce Ultimate Gift Card plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'mwb_wgm_preview_mail' and 'mwb_wgm_woocommerce_add_cart_item_data' functions in all versions up to, and including,
- 7.5 High severity
Gift Cards for WooCommerce Pro: Missing Authorization
The Ultimate Gift Cards for WooCommerce – Create WooCommerce Gift Cards, Gift Vouchers, Redeem & Manage Digital Gift Coupons. Offer Gift Certificates, Schedule Gift Cards, and Use Advance Coupons With Personalized Templates plugin for WordPress is vulnerable t
- 7.5 High severity
Wallet System for WooCommerce: Missing Authorization
Missing Authorization vulnerability in WP Swings Wallet System for WooCommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Wallet System for WooCommerce: from n/a through 2.5.13.
- 9.8 Critical severity
Points and Rewards for WooCommerce: Missing Authorization
Missing Authorization vulnerability in WP Swings Points and Rewards for WooCommerce.This issue affects Points and Rewards for WooCommerce: from n/a through 1.5.0.
- 9.8 Critical severity
Coupon Referral Program: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in WP Swings Coupon Referral Program allows Object Injection.This issue affects Coupon Referral Program: from n/a before 1.8.4.
- 7.5 High severity
Coupon Referral Program: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WP Swings Coupon Referral Program.This issue affects Coupon Referral Program: from n/a through 1.7.2.