Premmerce vulnerabilities

Products

• Premmerce Wishlist for WooCommerce 6
• Premmerce 5
• Premmerce User Roles 5
• Premmerce Permalink Manager for WooCommerce 4
• Premmerce Product Search for WooCommerce 4
• Premmerce Redirect Manager 4
• Premmerce Wholesale Pricing for WooCommerce 4
• Premmerce Brands for WooCommerce 3
• Premmerce Product Filter for WooCommerce 3
• Premmerce WooCommerce Customers Manager 2
• permalink manager for woocommerce 1
• Premmerce Dev Tools 1
• Premmerce Multi-currency for Woocommerce 1
• Premmerce SEO for WooCommerce 1
• Premmerce Variation Swatches for WooCommerce 1
• redirect manager 1

Latest Premmerce CVEs

Newest publication first · page 1 of 2

1. CVE-2026-97273 WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.13 - Cross Site Scripting (XSS) vulnerability

   Published 2026-10-01

   High·CVSS 7.1 EPSS 0.18%

   Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.

2. CVE-2026-97268 WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.13 - Cross Site Scripting (XSS) vulnerability

   Published 2026-10-01

   High·CVSS 7.1 EPSS 0.18%

   Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.

3. CVE-2026-97272 WordPress Premmerce Permalink Manager for WooCommerce plugin <= 2.3.13 - Cross Site Scripting (XSS) vulnerability

   Published 2026-09-30

   High·CVSS 7.1 EPSS 0.14%

   Unauthenticated Cross Site Scripting (XSS) in Premmerce Permalink Manager for WooCommerce <= 2.3.13 versions.

4. CVE-2026-54849 WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.11 - SQL Injection vulnerability

   Published 2026-06-25

   Critical·CVSS 9.3 EPSS 0.40%

   Unauthenticated SQL Injection in Premmerce Wishlist for WooCommerce <= 1.1.11 versions.

5. CVE-2026-6933 Premmerce Dev Tools <= 2.0 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via Plugin Creation

   Published 2026-06-16

   High·CVSS 8.8 EPSS 0.85%

   The Premmerce Dev Tools plugin for WordPress is vulnerable to Remote Code Execution via missing authorization in versions up to and including 2.0. This is due to the 'generatePluginHandler' function lacking any authorization check before processing user-supplied POST data, combin...

6. CVE-2024-13362 Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter

   Published 2026-05-01

   Medium·CVSS 6.1 EPSS 0.28%

   Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts...

7. CVE-2026-32541 WordPress Premmerce Redirect Manager plugin <= 1.0.12 - Broken Access Control vulnerability

   Published 2026-03-25

   Medium·CVSS 6.5 EPSS 0.18%

   Missing Authorization vulnerability in Premmerce Premmerce Redirect Manager premmerce-redirect-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premmerce Redirect Manager: from n/a through <= 1.0.12.

8. CVE-2026-0555 Premmerce <= 1.3.20 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'premmerce_wizard_actions' AJAX Endpoint

   Published 2026-02-07

   Medium·CVSS 6.4 EPSS 0.27%

   The Premmerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'premmerce_wizard_actions' AJAX endpoint in all versions up to, and including, 1.3.20. This is due to missing capability checks and insufficient input sanitization and output escaping on the s...

9. CVE-2025-13369 Premmerce WooCommerce Customers Manager <= 1.1.14 - Reflected Cross-Site Scripting

   Published 2026-01-07

   Medium·CVSS 6.1 EPSS 0.31%

   The Premmerce WooCommerce Customers Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'money_spent_from', 'money_spent_to', 'registered_from', and 'registered_to' parameters in all versions up to, and including, 1.1.14 due to insufficient input...

10. CVE-2025-13440 Premmerce Wishlist for WooCommerce <= 1.1.10 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Wishlist Deletion

    Published 2025-12-12

    Medium·CVSS 5.3 EPSS 0.36%

    The Premmerce Wishlist for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.1.10. This is due to a missing capability check on the deleteWishlist() function. This makes it possible for authenticated attackers, with Su...

11. CVE-2025-12783 Premmerce Brands for WooCommerce <= 1.2.13 - Missing Authorization To Authenticated (Subscriber+) Brand Permalink Settings Update

    Published 2025-12-12

    Medium·CVSS 4.3 EPSS 0.30%

    The Premmerce Brands for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveBrandsSettings function in all versions up to, and including, 1.2.13. This makes it possible for authenticated attackers, with...

12. CVE-2025-12411 Premmerce Wholesale Pricing for WooCommerce <= 1.1.10 - Authenticated (Subscriber+) SQL Injection

    Published 2025-11-18

    High·CVSS 7.1 EPSS 0.28%

    The Premmerce Wholesale Pricing for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'ID' parameter in versions up to, and including, 1.1.10. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the exist...

13. CVE-2025-60241 WordPress Premmerce plugin <= 1.3.19 - Local File Inclusion vulnerability

    Published 2025-11-06

    High·CVSS 7.5 EPSS 0.46%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Premmerce Premmerce premmerce allows PHP Local File Inclusion.This issue affects Premmerce: from n/a through <= 1.3.19.

14. CVE-2025-60194 WordPress Premmerce Product Search for WooCommerce plugin <= 2.2.4 - Local File Inclusion vulnerability

    Published 2025-11-06

    High·CVSS 7.5 EPSS 0.46%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Premmerce Premmerce Product Search for WooCommerce premmerce-search allows PHP Local File Inclusion.This issue affects Premmerce Product Search for WooCommerce...

15. CVE-2025-60193 WordPress Premmerce User Roles plugin <= 1.0.13 - Local File Inclusion vulnerability

    Published 2025-11-06

    High·CVSS 7.5 EPSS 0.46%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Premmerce Premmerce User Roles premmerce-user-roles allows PHP Local File Inclusion.This issue affects Premmerce User Roles: from n/a through <= 1.0.13.

16. CVE-2025-60192 WordPress Premmerce Wholesale Pricing for WooCommerce plugin <= 1.1.10 - Local File Inclusion vulnerability

    Published 2025-11-06

    High·CVSS 7.5 EPSS 0.46%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Premmerce Premmerce Wholesale Pricing for WooCommerce premmerce-woocommerce-wholesale-pricing allows PHP Local File Inclusion.This issue affects Premmerce Whol...

17. CVE-2025-60191 WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.10 - Local File Inclusion vulnerability

    Published 2025-11-06

    High·CVSS 7.5 EPSS 0.46%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Premmerce Premmerce Wishlist for WooCommerce premmerce-woocommerce-wishlist allows PHP Local File Inclusion.This issue affects Premmerce Wishlist for WooCommer...

18. CVE-2025-64291 WordPress Premmerce User Roles plugin <= 1.0.13 - Cross Site Scripting (XSS) vulnerability

    Published 2025-10-29

    Medium·CVSS 5.9 EPSS 0.18%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Premmerce Premmerce User Roles premmerce-user-roles allows Stored XSS.This issue affects Premmerce User Roles: from n/a through <= 1.0.13.

19. CVE-2025-64290 WordPress Premmerce Product Search for WooCommerce plugin <= 2.2.4 - Cross Site Request Forgery (CSRF) vulnerability

    Published 2025-10-29

    Medium·CVSS 4.3 EPSS 0.13%

    Cross-Site Request Forgery (CSRF) vulnerability in Premmerce Premmerce Product Search for WooCommerce premmerce-search allows Cross Site Request Forgery.This issue affects Premmerce Product Search for WooCommerce: from n/a through <= 2.2.4.

20. CVE-2025-64289 WordPress Premmerce Product Search for WooCommerce plugin <= 2.2.7 - Cross Site Scripting (XSS) vulnerability

    Published 2025-10-29

    Medium·CVSS 5.9 EPSS 0.18%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Premmerce Premmerce Product Search for WooCommerce premmerce-search allows Stored XSS.This issue affects Premmerce Product Search for WooCommerce: from n/a through 2.2.7.

21. CVE-2025-64288 WordPress Premmerce plugin <= 1.3.19 - Cross Site Request Forgery (CSRF) vulnerability

    Published 2025-10-29

    Medium·CVSS 4.3 EPSS 0.13%

    Cross-Site Request Forgery (CSRF) vulnerability in Premmerce Premmerce premmerce allows Cross Site Request Forgery.This issue affects Premmerce: from n/a through <= 1.3.19.

22. CVE-2025-64285 WordPress Premmerce Wholesale Pricing for WooCommerce plugin <= 1.1.10 - Broken Access Control vulnerability

    Published 2025-10-29

    Medium·CVSS 5.4 EPSS 0.22%

    Missing Authorization vulnerability in Premmerce Premmerce Wholesale Pricing for WooCommerce premmerce-woocommerce-wholesale-pricing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premmerce Wholesale Pricing for WooCommerce: from n/a th...

23. CVE-2025-62890 WordPress Premmerce Brands for WooCommerce plugin <= 1.2.13 - Cross Site Request Forgery (CSRF) vulnerability

    Published 2025-10-27

    Medium·CVSS 4.3 EPSS 0.14%

    Cross-Site Request Forgery (CSRF) vulnerability in Premmerce Premmerce Brands for WooCommerce premmerce-woocommerce-brands allows Cross Site Request Forgery.This issue affects Premmerce Brands for WooCommerce: from n/a through <= 1.2.13.

24. CVE-2025-62883 WordPress Premmerce User Roles plugin <= 1.0.13 - Broken Access Control vulnerability

    Published 2025-10-27

    Medium·CVSS 4.3 EPSS 0.25%

    Missing Authorization vulnerability in Premmerce Premmerce User Roles premmerce-user-roles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premmerce User Roles: from n/a through <= 1.0.13.

25. CVE-2023-41130 WordPress Premmerce User Roles plugin <= 1.0.12 - Broken Access Control vulnerability

    Published 2024-12-13

    High·CVSS 8.1 EPSS 0.62%

    Missing Authorization vulnerability in Premmerce Premmerce User Roles premmerce-user-roles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premmerce User Roles: from n/a through <= 1.0.12.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.