redefiningtheweb vulnerabilities

Products

• PDF Generator Addon for Elementor Page Builder 4
• affiliate pro 1
• Affiliate Pro - Affiliate Program for WooCommerce & WordPress 1
• Affiliate Program & Referral Tracking for WooCommerce & WordPress – Affilia 1
• BMA Lite 1
• Dynamic Pricing & Discounts Lite for WooCommerce 1
• PDF Generator for WordPress Elementor 1
• WordPress & WooCommerce Affiliate Program 1
• WordPress Contact Form 7 PDF, Google Sheet & Database 1

Latest redefiningtheweb CVEs

Newest publication first

1. CVE-2026-32558 WordPress Affiliate Pro - Affiliate Program for WooCommerce & WordPress plugin <= 8.9.1 - Privilege Escalation vulnerability

   Published 2026-08-24

   Critical·CVSS 9.8 EPSS 0.48%

   Unauthenticated Privilege Escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPress <= 8.9.1 versions.

2. CVE-2026-7559 Affilia <= 3.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Status Modification

   Published 2026-07-11

   Medium·CVSS 4.3 EPSS 0.53%

   The Affilia – Affiliate Program & Referral Tracking for WordPress plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 3.3.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it...

3. CVE-2025-64231 WordPress WordPress Contact Form 7 PDF, Google Sheet & Database plugin <= 3.0.0 - Arbitrary File Upload vulnerability

   Published 2025-12-18

   Critical·CVSS 9.9 EPSS 0.32%

   Unrestricted Upload of File with Dangerous Type vulnerability in RedefiningTheWeb WordPress Contact Form 7 PDF, Google Sheet & Database rtwwcfp-wordpress-contact-form-7-pdf allows Using Malicious Files.This issue affects WordPress Contact Form 7 PDF, Google Sheet & Database: from...

4. CVE-2025-48342 WordPress Dynamic Pricing & Discounts Lite for WooCommerce plugin <= 2.0.3 - Cross Site Request Forgery (CSRF) vulnerability

   Published 2025-05-19

   Medium·CVSS 5.4 EPSS 0.15%

   Cross-Site Request Forgery (CSRF) vulnerability in RedefiningTheWeb Dynamic Pricing & Discounts Lite for WooCommerce woo-dynamic-pricing-discounts-lite allows Cross Site Request Forgery.This issue affects Dynamic Pricing & Discounts Lite for WooCommerce: from n/a through <= 2.0.4...

5. CVE-2025-39518 WordPress BMA Lite plugin <= 1.4.2 - SQL Injection vulnerability

   Published 2025-04-16

   High·CVSS 7.6 EPSS 0.59%

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RedefiningTheWeb BMA Lite bma-lite-appointment-booking-and-scheduling allows SQL Injection.This issue affects BMA Lite: from n/a through <= 1.4.2.

6. CVE-2025-31850 WordPress PDF Generator Addon for Elementor Page Builder plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability

   Published 2025-04-01

   Medium·CVSS 6.5 EPSS 0.28%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RedefiningTheWeb PDF Generator Addon for Elementor Page Builder pdf-generator-addon-for-elementor-page-builder allows Stored XSS.This issue affects PDF Generator Addon for Elemen...

7. CVE-2025-24569 WordPress PDF Generator Addon for Elementor Page Builder plugin <= 1.7.5 - Arbitrary File Read vulnerability

   Published 2025-02-03

   High·CVSS 7.5 EPSS 0.58%

   Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in RedefiningTheWeb PDF Generator Addon for Elementor Page Builder pdf-generator-addon-for-elementor-page-builder allows Path Traversal.This issue affects PDF Generator Addon for Elemento...

8. CVE-2024-9935 PDF Generator Addon for Elementor Page Builder <= 2.0.0 - Unauthenticated Arbitrary File Download

   Published 2024-11-16

   High·CVSS 7.5 EPSS 7.6%

   The PDF Generator Addon for Elementor Page Builder plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.0.0 via the rtw_pgaepb_dwnld_pdf() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary file...

9. CVE-2024-50449 WordPress PDF Generator Addon for Elementor Page Builder plugin <= 1.7.4 - Cross Site Scripting (XSS) vulnerability

   Published 2024-10-28

   Medium·CVSS 5.4 EPSS 0.27%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RedefiningTheWeb PDF Generator Addon for Elementor Page Builder pdf-generator-addon-for-elementor-page-builder allows Stored XSS.This issue affects PDF Generator Addon for Elemen...

10. CVE-2024-9289 WordPress & WooCommerce Affiliate Program <= 8.4.1 - Authentication Bypass to Account Takeover and Privilege Escalation

    Published 2024-10-01

    Critical·CVSS 9.8 EPSS 0.58%

    The WordPress & WooCommerce Affiliate Program plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 8.4.1. This is due to the rtwwwap_login_request_callback() function not properly validating a user's identity prior to authenticating th...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.