wpexpertsio vulnerabilities

Products

• APIExperts Square for WooCommerce 1
• Email Templates Customizer and Designer for WordPress and WooCommerce 1
• New User Approve 1
• Rocket Maintenance Mode & Coming Soon Page 1
• WC Shop Sync – Integrate Square and WooCommerce for Seamless Shop Management 1
• WP Multi Store Locator Pro 1
• WP Multistore Locator — WP Store Locator Plugin: Effortless Integration With Snazzy Maps 1

Latest wpexpertsio CVEs

Newest publication first

1. CVE-2026-15275 WP Multi Store Locator Pro <= 4.5.1 - Unauthenticated SQL Injection via 'store_locator_search_radius' Parameter

   Published 2026-09-18

   High·CVSS 7.5 EPSS 0.53%

   The WP Multi Store Locator Pro plugin for WordPress is vulnerable to generic SQL Injection via the 'store_locatore_search_radius' parameter in all versions up to, and including, 4.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation o...

2. CVE-2024-12475 WP Multi Store Locator <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

   Published 2025-01-04

   Medium·CVSS 5.4 EPSS 0.32%

   The WP Multi Store Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access a...

3. CVE-2022-47182 WordPress APIExperts Square for WooCommerce plugin <= 4.4.1 - Broken Access Control

   Published 2024-12-13

   Medium·CVSS 5.3 EPSS 0.53%

   Missing Authorization vulnerability in Wpexpertsio APIExperts Square for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for WooCommerce: from n/a through 4.4.1.

4. CVE-2024-27959 WordPress APIExperts Square for WooCommerce plugin <= 4.2.9 - Cross Site Scripting (XSS) vulnerability

   Published 2024-03-17

   Medium·CVSS 6.1 EPSS 0.37%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpexpertsio WC Shop Sync – Integrate Square and WooCommerce for Seamless Shop Management allows Reflected XSS.This issue affects WC Shop Sync – Integrate Square and WooCommerce f...

5. CVE-2023-50902 WordPress New User Approve Plugin <= 2.5.1 is vulnerable to Cross Site Request Forgery (CSRF)

   Published 2023-12-29

   High·CVSS 8.8 EPSS 0.23%

   Cross-Site Request Forgery (CSRF) vulnerability in WPExpertsio New User Approve.This issue affects New User Approve: from n/a through 2.5.1.

6. CVE-2023-49842 WordPress Rocket Maintenance Mode & Coming Soon Page Plugin <= 4.3 is vulnerable to Cross Site Scripting (XSS)

   Published 2023-12-14

   Medium·CVSS 4.8 EPSS 0.39%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpexpertsio Rocket Maintenance Mode & Coming Soon Page allows Stored XSS.This issue affects Rocket Maintenance Mode & Coming Soon Page: from n/a through 4.3.

7. CVE-2022-47181 WordPress Email Templates Plugin <= 1.4.2 is vulnerable to Cross Site Request Forgery (CSRF)

   Published 2023-11-07

   High·CVSS 8.8 EPSS 0.35%

   Cross-Site Request Forgery (CSRF) vulnerability in wpexpertsio Email Templates Customizer and Designer for WordPress and WooCommerce email-templates allows Cross Site Request Forgery.This issue affects Email Templates Customizer and Designer for WordPress and WooCommerce: from n/...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.