Wpswings develops a modestly sized portfolio of WooCommerce extensions and plugins focused on e-commerce workflows such as refunds, coupons, gift cards, and payment wallet functionality. Vulnerabilities affecting this vendor skew strongly toward critical-severity outcomes and frequently acquire public exploit code, with the exposure clustering around authorization and access-control weaknesses—including improper authorization, authorization bypass, and cross-site request forgery—that recur across its product line and reflect the sensitive financial and customer data that these commerce plugins handle. Defenders should prioritize patching these extensions given the elevated severity profile and the direct access such plugins grant to transaction and customer records; live exploitation and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Wpswings over time
Signals from CVEs in this vendor scope (23 CVEs).
23 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-4395CRITICAL The Membership For WooCommerce WordPress plugin before 2.1.7 does not validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as malicious | Jan 30, 2023 | 9.8 | 43 | NO | YES |
CVE-2024-8425CRITICAL The WooCommerce Ultimate Gift Card plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'mwb_wgm_preview_mail' and 'mwb_wgm_ | Feb 28, 2025 | 9.8 | 41 | NO | YES |
CVE-2026-57407HIGH Server-Side Request Forgery (SSRF) vulnerability in WP Swings PDF Generator for WordPress pdf-generator-for-wp allows Server Side Request Forgery.This issue affects PDF Generator f | Jul 13, 2026 | 7.2 | 33 | NO | NO |
CVE-2022-4047CRITICAL The Return Refund and Exchange For WooCommerce WordPress plugin before 4.0.9 does not validate attachment files to be uploaded via an AJAX action available to unauthenticated users | Dec 26, 2022 | 9.8 | 33 | NO | NO |
CVE-2024-25100CRITICAL Deserialization of Untrusted Data vulnerability in WP Swings Coupon Referral Program allows Object Injection.This issue affects Coupon Referral Program: from n/a before 1.8.4. | Feb 12, 2024 | 9.8 | 30 | NO | NO |
CVE-2022-4321MEDIUM The PDF Generator for WordPress plugin before 1.1.2 includes a vendored dompdf example file which is susceptible to Reflected Cross-Site Scripting and could be used against high pr | Feb 6, 2023 | 6.1 | 30 | NO | YES |
CVE-2023-27608CRITICAL Missing Authorization vulnerability in WP Swings Points and Rewards for WooCommerce.This issue affects Points and Rewards for WooCommerce: from n/a through 1.5.0. | Mar 25, 2024 | 9.8 | 27 | NO | NO |
CVE-2026-10628MEDIUM The Points and Rewards for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.10.0. This is due to the plugin not proper | Jul 11, 2026 | 4.3 | 24 | NO | NO |
CVE-2026-24581MEDIUM Missing Authorization vulnerability in WP Swings Points and Rewards for WooCommerce points-and-rewards-for-woocommerce allows Exploiting Incorrectly Configured Access Control Secur | Jan 23, 2026 | 5.4 | 23 | NO | NO |
CVE-2024-13641HIGH The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features plugin for WordPress is vulnerable to Sensitive Informatio | Feb 14, 2025 | 7.5 | 21 | NO | NO |
Signals from CVEs in this vendor scope (23 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Wpswings.
Media articles that mention a CVE ID that affects a product developed by Wpswings — matched by CVE ID, not by vendor name.