StoreApps vulnerabilities

Products

• Smart Manager 5
• Stock Manager for WooCommerce 3
• affiliate for woocommerce 2
• Affiliate For WooCommerce (WordPress plugin) 2
• News Announcement Scroll 2
• News Announcement Scroll (WordPress plugin) 1
• Smart Manager – WooCommerce Bulk Edit: Products, Orders, Users & More (Spreadsheet) 1
• temporary login without password 1
• WooCommerce Stock Manager 1

Latest StoreApps CVEs

Newest publication first

1. CVE-2026-18443 Smart Manager <= 8.97.0 - Authenticated (Subscriber+) SQL Injection to Privilege Escalation via 'access_privileges' Parameter

   Published 2026-10-03

   High·CVSS 8.8

   The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via the 'access_privileges' parameter in all versions up to, and including, 8.97.0 due to insufficient escaping on the user supplied parameter and...

2. CVE-2026-57704 WordPress Smart Manager plugin <= 8.90.0 - Cross Site Scripting (XSS) vulnerability

   Published 2026-07-23

   High·CVSS 7.1

   Unauthenticated Cross Site Scripting (XSS) in Smart Manager <= 8.90.0 versions.

3. CVE-2026-45216 WordPress Smart Manager plugin <= 8.85.0 - Privilege Escalation vulnerability

   Published 2026-05-25

   High·CVSS 8.8

   Incorrect Privilege Assignment vulnerability in StoreApps Smart Manager allows Privilege Escalation. This issue affects Smart Manager: from n/a through 8.85.0.

4. CVE-2026-24365 WordPress Stock Manager for WooCommerce plugin < 3.6.0 - Cross Site Request Forgery (CSRF) vulnerability

   Published 2026-01-22

   Medium·CVSS 5.4

   Cross-Site Request Forgery (CSRF) vulnerability in storeapps Stock Manager for WooCommerce woocommerce-stock-manager allows Cross Site Request Forgery.This issue affects Stock Manager for WooCommerce: from n/a through < 3.6.0.

5. CVE-2025-22710 WordPress Smart Manager Plugin <= 8.52.0 - SQL Injection vulnerability

   Published 2025-01-21

   High·CVSS 7.6

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in storeapps Smart Manager smart-manager-for-wp-e-commerce allows Blind SQL Injection.This issue affects Smart Manager: from n/a through <= 8.52.0.

6. CVE-2024-49687 WordPress Smart Manager plugin <= 8.45.0 - Broken Access Control vulnerability

   Published 2024-12-31

   Medium·CVSS 4.3

   Missing Authorization vulnerability in storeapps Smart Manager smart-manager-for-wp-e-commerce.This issue affects Smart Manager: from n/a through <= 8.45.0.

7. CVE-2023-5663 News Announcement Scroll <= 9.0.0 - Authenticated (Contributor+) SQL Injection via Shortcode

   Published 2024-03-13

   High·CVSS 8.8

   The News Announcement Scroll plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 9.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...

8. CVE-2024-0566 Smart Manager < 8.28.0 - Admin+ SQL Injection

   Published 2024-02-12

   High·CVSS 7.2 EPSS 3.3%

   The Smart Manager WordPress plugin before 8.28.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.

9. CVE-2023-35091 WordPress WooCommerce Stock Manager Plugin <= 2.10.0 is vulnerable to Cross Site Request Forgery (CSRF)

   Published 2023-07-11

   High·CVSS 8.8

   Cross-Site Request Forgery (CSRF) vulnerability in StoreApps Stock Manager for WooCommerce plugin <= 2.10.0 versions.

10. CVE-2022-40694 WordPress News Announcement Scroll plugin <= 8.8.8 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

    Published 2022-11-17

    Medium·CVSS 4.8

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in News Announcement Scroll plugin <= 8.8.8 on WordPress.

11. CVE-2022-36284 WordPress Affiliate For WooCommerce premium plugin <= 4.7.0 - Authenticated IDOR vulnerability leading to PayPal email change

    Published 2022-08-05

    Medium·CVSS 6.5

    Authenticated IDOR vulnerability in StoreApps Affiliate For WooCommerce premium plugin <= 4.7.0 at WordPress allows an attacker to change the PayPal email. WooCommerce PayPal Payments plugin (free) should be at least installed to get the extra input field on the user profile page...

12. CVE-2022-25649 WordPress Affiliate For WooCommerce premium plugin <= 4.7.0 - Multiple Improper Access Control vulnerabilities

    Published 2022-08-05

    High·CVSS 8.8

    Multiple Improper Access Control vulnerabilities in StoreApps Affiliate For WooCommerce premium plugin <= 4.7.0 at WordPress.

13. CVE-2021-24836 Temporary Login Without Password < 1.7.1 - Subscriber+ Plugin's Settings Update

    Published 2021-12-13

    Medium·CVSS 4.3

    The Temporary Login Without Password WordPress plugin before 1.7.1 does not have authorisation and CSRF checks when updating its settings, which could allows any logged-in users, such as subscribers to update them

14. CVE-2021-34619 Cross-Site Request Forgery in WooCommerce Stock Manager WordPress Plugin

    Published 2021-07-21

    High·CVSS 8.8

    The WooCommerce Stock Manager WordPress plugin is vulnerable to Cross-Site Request Forgery leading to Arbitrary File Upload in versions up to, and including, 2.5.7 due to missing nonce and file validation in the /woocommerce-stock-manager/trunk/admin/views/import-export.php file.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.