Wpdesk vulnerabilities
We track 4 vulnerabilities in Wpdesk products across 4 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on October 14, 2026.
Latest Wpdesk vulnerabilities
- 8.1 High severity
ShopMagic – email automation for WordPress: Improper Control of Filename for Include/Require Statement in PHP Program
The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the 'billing_address.first_name' parameter parameter. This makes it possible for unauthenticated attackers
- 7.1 High severity
Flexible PDF Invoices for WooCommerce &…: Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in wpdesk Flexible PDF Invoices for WooCommerce & WordPress flexible-invoices allows Cross Site Request Forgery.This issue affects Flexible PDF Invoices for WooCommerce & WordPress: from n/a through <= 6.0.13.
- 7.2 High severity
Flexible Wishlist for WooCommerce – Ecommerce…: Improper Neutralization of Input During Web Page Generation
The Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wishlist_name’ parameter in all versions up to, and including, 1.2.25 due to insufficient input sanitization
- 8.8 High severity
Flexible Checkout Fields for WooCommerce: Missing Authorization
Missing Authorization vulnerability in WP Desk Flexible Checkout Fields for WooCommerce.This issue affects Flexible Checkout Fields for WooCommerce: from n/a through 4.1.2.