Cedcommerce develops e-commerce plugins and extensions for WooCommerce and other marketplace platforms, with a focused product portfolio centered on wholesale, ordering, and product-discovery features. Its vulnerability profile reflects typical web-application exposure: cross-site scripting and cross-site request forgery vulnerabilities recur across its plugins, alongside authorization and access-control weaknesses, and vulnerabilities affecting the vendor skew toward serious outcomes. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Cedcommerce over time
Signals from CVEs in this vendor scope (8 CVEs).
8 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-4298CRITICAL The Wholesale Market WordPress plugin before 2.2.1 does not have authorisation check, as well as does not validate user input used to generate system path, allowing unauthenticated | Jan 2, 2023 | 9.8 | 29 | NO | NO |
CVE-2022-4363MEDIUM The Wholesale Market WordPress plugin before 2.2.2, Wholesale Market for WooCommerce WordPress plugin before 2.0.1 have a flawed CSRF check when updating their settings, which coul | May 16, 2025 | 6.5 | 21 | NO | NO |
CVE-2022-4108MEDIUM The Wholesale Market for WooCommerce WordPress plugin before 1.0.8 does not validate user input used to generate system path, allowing high privilege users such as admin to downloa | Dec 19, 2022 | 4.9 | 19 | NO | NO |
CVE-2022-4106HIGH The Wholesale Market for WooCommerce WordPress plugin before 1.0.7 does not have authorisation check, as well as does not validate user input used to generate system path, allowing | Dec 19, 2022 | 7.5 | 19 | NO | NO |
CVE-2024-5641MEDIUM The One Click Order Re-Order plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ced_ocor_save_general_setting' functi | Jul 4, 2024 | 5.4 | 17 | NO | NO |
CVE-2022-4107MEDIUM The SMSA Shipping for WooCommerce WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks, as well as does not validate the file to be downloaded, allowing | Dec 19, 2022 | 6.5 | 17 | NO | NO |
The Wholesale Market for WooCommerce WordPress plugin before 2.0.0 does not validate user input against path traversal attacks, allowing high privilege users such as admin to downl | Jan 2, 2023 | 2.7 | 16 | NO | NO |
CVE-2023-47646MEDIUM Auth. (Shop Manager+) Stored Cross-Site Scripting (XSS) vulnerability in CedCommerce Recently viewed and most viewed products plugin <= 1.1.1 versions. | Nov 14, 2023 | 4.8 | 15 | NO | NO |
Signals from CVEs in this vendor scope (8 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Cedcommerce.
Media articles that mention a CVE ID that affects a product developed by Cedcommerce — matched by CVE ID, not by vendor name.