Cancel Order Request Woocommerce Vulnerabilities

The Cancel Order & Request Woocommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.3.4.33. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 1.3.4.33

Fixed in:

1.3.4.34

Disclosed:

Aug 3, 2026

CVE-2026-18603 on NVD →

The Cancel order request WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to...

CVSS:

4.4

Affected:

up to 1.3.2

Fixed in:

1.3.3

Disclosed:

Apr 6, 2023

CVE-2023-29423 on NVD →