powerfulwp vulnerabilities

Products

• Local Delivery Drivers for WooCommerce 3
• Gift Message for WooCommerce 1

Latest powerfulwp CVEs

Newest publication first

1. CVE-2026-66468 WordPress Local Delivery Drivers for WooCommerce plugin <= 3.0.0 - Cross Site Scripting (XSS) vulnerability

   Published 2026-08-13

   High·CVSS 7.1

   Unauthenticated Cross Site Scripting (XSS) in Local Delivery Drivers for WooCommerce <= 3.0.0 versions.

2. CVE-2022-4974 Freemius SDK <= 2.4.2 - Missing Authorization Checks

   Published 2024-10-16

   Medium·CVSS 6.3

   The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in...

3. CVE-2023-51481 WordPress Local Delivery Drivers for WooCommerce plugin <= 1.9.0 - Unauthenticated Account Takeover vulnerability

   Published 2024-05-17

   Critical·CVSS 9.8

   Improper Privilege Management vulnerability in powerfulwp Local Delivery Drivers for WooCommerce allows Privilege Escalation.This issue affects Local Delivery Drivers for WooCommerce: from n/a through 1.9.0.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.