Addify develops a focused line of WordPress and WooCommerce e-commerce plugins that enhance checkout, pricing, and user-management functionality for online stores, and vulnerabilities affecting the vendor skew toward serious outcomes with a meaningful share reaching critical severity. The exposure recurs across products such as Role-Based Pricing for WooCommerce, Abandoned Cart Recovery, and Advanced Free Gifts through weakness classes including cross-site request forgery, SQL injection, improper privilege management, and missing authorization—issues typical of web-facing plugins where insufficient input handling and access control create direct pathways to store data and administrative operations. Defenders should treat this vendor's advisories as applicable across affected WooCommerce deployments; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Addify over time
Signals from CVEs in this vendor scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-44025CRITICAL SQL injection vulnerability in addify Addifyfreegifts v.1.0.2 and before allows a remote attacker to execute arbitrary code via a crafted script to the getrulebyid function in the | Nov 1, 2023 | 9.8 | 28 | NO | NO |
CVE-2022-3537HIGH The Role Based Pricing for WooCommerce WordPress plugin before 1.6.2 does not have authorisation and proper CSRF checks, and does not validate files to be uploaded, allowing any au | Nov 7, 2022 | 8.8 | 28 | NO | NO |
CVE-2022-3536HIGH The Role Based Pricing for WooCommerce WordPress plugin before 1.6.3 does not have authorisation and proper CSRF checks, as well as does not validate path given via user input, all | Nov 7, 2022 | 8.8 | 28 | NO | NO |
CVE-2022-3419MEDIUM The Automatic User Roles Switcher WordPress plugin before 1.1.2 does not have authorisation and proper CSRF checks, allowing any authenticated users like subscriber to add any role | Oct 31, 2022 | 6.5 | 22 | NO | NO |
CVE-2022-4888MEDIUM The Checkout Fields Manager WordPress plugin before 1.0.2, Abandoned Cart Recovery WordPress plugin before 1.2.5, Custom Fields for WooCommerce WordPress plugin before 1.0.4, Custo | Jul 31, 2023 | 6.5 | 19 | NO | NO |
CVE-2022-3451MEDIUM The Product Stock Manager WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks in multiple AJAX actions, allowing users with a role as low as subscriber | Nov 7, 2022 | 4.3 | 14 | NO | NO |
Signals from CVEs in this vendor scope (6 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Addify.
Media articles that mention a CVE ID that affects a product developed by Addify — matched by CVE ID, not by vendor name.