Vendor

    WP Desk

    18 known vulnerabilities in products by WP Desk, 0 of them actively exploited (CISA KEV).

    Key figures

    18

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    1

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in WP Desk
    HighCVE-2026-103367

    ShopMagic <= 4.9.0 - Unauthenticated Local File Inclusion via 'billing.first_name' Parameter

    		8.1
    CriticalCVE-2026-73364

    WordPress Flexible Subscriptions plugin <= 1.8.1 - PHP Object Injection vulnerability

    		9.8
    HighCVE-2020-36731

    Flexible Checkout Fields for WooCommerce <= 2.3.1 - Unauthenticated Arbitrary Plugin Settings Update

    		7.2
    HighCVE-2026-116861

    WordPress Flexible Chat plugin <= 1.1.0 - Sensitive Data Exposure vulnerability

    		7.5
    MediumCVE-2026-57425

    WordPress Autopay dla WooCommerce plugin <= 2.2.27 - Broken Access Control vulnerability

    		6.5
    MediumCVE-2026-62081

    Wpdesk Flexible PDF Coupons: Authorization Bypass Through User-Controlled Key

    		5.4
    MediumCVE-2026-62136

    Missing Authorization (CVE-2026-62136)

    		5.3
    MediumCVE-2026-57402

    Wpdesk Flexible Refund and Return Order for WooCommerce: Cross-site Scripting

    		6.5
    HighCVE-2024-13696

    Cross-site Scripting (CVE-2024-13696)

    		7.2
    HighCVE-2025-57977

    Wpdesk Flexible PDF Invoices for WooCommerce & WordPress: Cross-Site Request Forgery (CSRF)

    		7.1
    MediumCVE-2025-59578

    WordPress ShopMagic plugin <= 4.5.6 - Sensitive Data Exposure vulnerability

    		5.8
    MediumCVE-2025-12621

    Wpdesk Flexible Refund and Return Order for WooCommerce: Incorrect Authorization

    		5.3
    MediumCVE-2025-22825

    WordPress Flexible PDF Coupons plugin < 1.10.3 - Stored Cross Site Scripting (XSS) vulnerability

    		6.5
    MediumCVE-2025-69093

    WordPress ShopMagic plugin <= 4.7.2 - Broken Access Control vulnerability

    		5.3
    MediumCVE-2025-10570

    Wpdesk Flexible Refund and Return Order for WooCommerce: Authorization Bypass Through User-Controlled Key

    		4.3
    HighCVE-2024-31267

    WP Desk Flexible Checkout Fields for WooCommerce: Missing Authorization

    also in 1 other product

    		4.3
    MediumCVE-2025-30805

    WordPress Flexible Cookies plugin <= 1.1.8 - Cross Site Request Forgery (CSRF) vulnerability

    		4.3
    MediumCVE-2024-13718

    Wpdesk Flexible Wishlist For Woocommerce: Cross-Site Request Forgery (CSRF)

    		4.3

    Products

    Products by WP Desk
    Flexible Refund And Return Order For Woocommerce30