Advisories · Technology

wpclever WPC Smart Messages for WooCommerce.

Every CVE that names wpclever WPC Smart Messages for WooCommerce among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-6725 CVE record

CVSS 6.4 Medium

WPC Smart Messages for WooCommerce <= 4.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attribute
- wpclever WPC Smart Messages for WooCommerce
- Cross-site scripting (XSS)
Not analysed yet 28 Apr 2026
CVE-2025-62903 CVE record

CVSS 6.5 Medium

WordPress WPC Smart Messages for WooCommerce plugin <= 4.2.8 - Cross Site Scripting (XSS) vulnerability
- WPClever WPC Smart Messages for WooCommerce
- Cross-site scripting (XSS)
Not analysed yet 27 Oct 2025
CVE-2024-10437 CVE record

CVSS 4.3 Medium

WPC Smart Messages for WooCommerce <= 4.2.1 - Missing Authorization to Authenticated (Subscriber+) Message Activation/Deactivation
- wpclever WPC Smart Messages for WooCommerce
- Broken access control
Not analysed yet 29 Oct 2024
CVE-2024-10436 CVE record

CVSS 8.8 High

WPC Smart Messages for WooCommerce <= 4.2.1 - Authenticated (Subscriber+) Local File Inclusion
- wpclever WPC Smart Messages for WooCommerce
- File inclusion
Not analysed yet 29 Oct 2024