Wpclever vulnerabilities
We track 14 vulnerabilities in Wpclever products across 10 products. 14 are rated high or critical, and none are known to be exploited. The most recent was published on October 3, 2026.
Latest Wpclever vulnerabilities
- 7.2 High severity
WPC Product Options for WooCommerce: Improper Neutralization of Input During Web Page Generation
The WPC Product Options for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wpcpo-* Array Key via Multipart Field Name in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. Thi
- 8.8 High severity
WPC Shop as a Customer for WooCommerce: Improper Privilege Management
The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0 This is due to the plugin not properly validating the target user's role prior to issuing a n
- 7.2 High severity
WPC Product Bundles for WooCommerce: Improper Neutralization of Input During Web Page Generation
The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qty' parameter in all versions up to, and including, 8.6.6 due to insufficient input sanitization and output escaping. This makes it possible for
- 7.5 High severity
WPC Product Options for WooCommerce: Improper Control of Filename for Include/Require Statement in PHP Program
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WPClever WPC Product Options for WooCommerce wpc-product-options allows PHP Local File Inclusion.This issue affects WPC Product Options for
- 7.5 High severity
WPC Name Your Price for WooCommerce: Client-Side Enforcement of Server-Side Security
The WPC Name Your Price for WooCommerce plugin for WordPress is vulnerable to unauthorized price alteration in all versions up to, and including, 2.1.9. This is due to the plugin not disabling the ability to name a custom price when it has been specifically di
- 8.8 High severity
WPC Admin Columns: Improper Privilege Management
The WPC Admin Columns plugin for WordPress is vulnerable to privilege escalation in versions 2.0.6 to 2.1.0. This is due to the plugin not properly restricting user meta values that can be updated through the ajax_edit_save() function. This makes it possible f
- 8.8 High severity
WPC Smart Linked Products - Upsells &…: Missing Authorization
Missing Authorization vulnerability in WPClever WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce wpc-smart-linked-products allows Privilege Escalation.This issue affects WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce: from n
- 8.8 High severity
WPC Smart Upsell Funnel for WooCommerce: Missing Authorization
Missing Authorization vulnerability in WPClever WPC Smart Upsell Funnel for WooCommerce wpc-smart-upsell-funnel allows Privilege Escalation.This issue affects WPC Smart Upsell Funnel for WooCommerce: from n/a through <= 3.0.4.
- 8.1 High severity
WPC Shop as a Customer for WooCommerce: Use of Insufficiently Random Values
The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to account takeover and privilege escalation in all versions up to, and including, 1.2.8. This is due to the 'generate_key' function not producing a sufficiently random value. This m
- 8.8 High severity
WPC Frequently Bought Together for WooCommerce: Missing Authorization
Missing Authorization vulnerability in WPClever WPC Frequently Bought Together for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPC Frequently Bought Together for WooCommerce: from n/a through 7.1.9.
- 8.8 High severity
WPC Smart Messages for WooCommerce: Improper Control of Filename for Include/Require Statement in PHP Program
The WPC Smart Messages for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.2.1 via the get_condition_value function. This makes it possible for authenticated attackers, with Subscriber-level access
- 8.8 High severity
WPC Shop as a Customer for WooCommerce: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in WPClever WPC Shop as a Customer for WooCommerce wpc-shop-as-customer allows Object Injection.This issue affects WPC Shop as a Customer for WooCommerce: from n/a through <= 1.2.6.
- 8.8 High severity
WPC Badge Management for WooCommerce: Missing Authorization
Missing Authorization vulnerability in WPClever WPC Badge Management for WooCommerce.This issue affects WPC Badge Management for WooCommerce: from n/a through 2.4.0.
- 8.8 High severity
WPC Product Bundles for WooCommerce: Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in WPClever WPC Product Bundles for WooCommerce.This issue affects WPC Product Bundles for WooCommerce: from n/a through 7.3.1.