Xootix develops a focused line of WordPress and WooCommerce plugins centered on user engagement features such as login popups, shopping carts, waitlists, and authentication forms. The recurring exposure reflects the application-layer input and access-control demands of these plugins: the vendor's disclosures cluster around cross-site scripting, missing or improper authorization, cross-site request forgery, and authentication weaknesses that are characteristic of web-facing form and session-handling code. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Xootix over time
Signals from CVEs in this vendor scope (10 CVEs).
10 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-45376HIGH Cross-Site Request Forgery (CSRF) vulnerability in XootiX Side Cart Woocommerce (Ajax) < 2.1 versions. | May 22, 2023 | 8.8 | 27 | NO | NO |
CVE-2022-0215HIGH The Login/Signup Popup, Waitlist Woocommerce ( Back in stock notifier ), and Side Cart Woocommerce (Ajax) WordPress plugins by XootiX are vulnerable to Cross-Site Request Forgery v | Jan 18, 2022 | 8.8 | 27 | NO | NO |
CVE-2024-5324HIGH Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the 'import_settings' functio | Jun 6, 2024 | 8.8 | 26 | NO | NO |
CVE-2023-2706HIGH The OTP Login Woocommerce & Gravity Forms plugin for WordPress is vulnerable to authentication bypass. This is due to the fact that when generating OTP codes for users to use in or | May 17, 2023 | 8.1 | 26 | NO | NO |
CVE-2025-50027MEDIUM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xootix Login/Signup Popup easy-login-woocommerce allows Stored XSS.This issue | Jun 20, 2025 | 5.9 | 18 | NO | NO |
CVE-2024-8724MEDIUM The Waitlist Woocommerce ( Back in stock notifier ) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escapin | Sep 14, 2024 | 6.1 | 18 | NO | NO |
CVE-2020-36715MEDIUM The Login/Signup Popup plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on several functions in versions up to, and including, 1.4. This | Jun 7, 2023 | 4.6 | 18 | NO | NO |
CVE-2025-1064MEDIUM The Login/Signup Popup ( Inline Form + Woocommerce ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's xoo_el_action shortcode in all versions up t | Feb 20, 2025 | 5.4 | 16 | NO | NO |
CVE-2023-28415MEDIUM Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in XootiX Side Cart Woocommerce (Ajax) plugin <= 2.2 versions. | Aug 30, 2023 | 4.8 | 16 | NO | NO |
CVE-2024-5665MEDIUM The Login/Signup Popup ( Inline Form + Woocommerce ) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ‘export_settings’ fu | Jun 6, 2024 | 4.3 | 15 | NO | NO |
Signals from CVEs in this vendor scope (10 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Xootix.
Media articles that mention a CVE ID that affects a product developed by Xootix — matched by CVE ID, not by vendor name.