Currency Switcher Vulnerabilities

The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that wil...

CVSS:

7.2

Affected:

up to 1.3.1

Fixed in:

1.3.2

Disclosed:

May 25, 2026

CVE-2026-42733 on NVD →

The The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.2.0.4. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it po...

CVSS:

7.3

Affected:

up to 1.2.0.4

Fixed in:

1.2.0.5

Disclosed:

Mar 10, 2025

CVE-2025-2169 on NVD →

[en] Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in realmag777 WPCS allows Code Injection.This issue affects WPCS: from n/a through 1.2.0.3.

Affected:

up to 1.2.0.4

Fixed in:

1.2.0.4

Disclosed:

Jul 12, 2024

CVE-2024-38700 on NVD →

The The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.2.0.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it po...

CVSS:

6.5

Affected:

up to 1.2.0.3

Fixed in:

1.2.0.4

Disclosed:

Jul 10, 2024

CVE-2024-38700 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WPCS.This issue affects WPCS: from n/a through 1.2.0.1.

Affected:

up to 1.2.0.2

Fixed in:

1.2.0.2

Disclosed:

Mar 29, 2024

CVE-2024-30456 on NVD →

The WPCS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.0.1. This is due to missing or incorrect nonce validation on the save_etalon() function. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they...

CVSS:

4.3

Affected:

up to 1.2.0.1

Fixed in:

1.2.0.2

Disclosed:

Mar 28, 2024

CVE-2024-30456 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WPCS – WordPress Currency Switcher Professional allows Stored XSS.This issue affects WPCS – WordPress Currency Switcher Professional: from n/a through 1.2.0.

Affected:

up to 1.2.0.1

Fixed in:

1.2.0.1

Disclosed:

Feb 1, 2024

CVE-2023-51506 on NVD →

The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-le...

CVSS:

6.4

Affected:

up to 1.2.0

Fixed in:

1.2.0.1

Disclosed:

Dec 27, 2023

CVE-2023-51506 on NVD →

[en] The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the anonymous function for the wpcs_sd_delete action in versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with sub...

Affected:

up to 1.2.0

Fixed in:

1.2.0

Disclosed:

Jun 9, 2023

CVE-2023-2556 on NVD →

[en] The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcs_current_currency shortcode in versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possib...

Affected:

up to 1.2.0

Fixed in:

1.2.0

Disclosed:

Jun 9, 2023

CVE-2023-2558 on NVD →

[en] The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the create function in versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level permissions and abo...

Affected:

up to 1.2.0

Fixed in:

1.2.0

Disclosed:

Jun 9, 2023

CVE-2023-2555 on NVD →

[en] The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save function in versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level permissions and above...

Affected:

up to 1.2.0

Fixed in:

1.2.0

Disclosed:

Jun 9, 2023

CVE-2023-2557 on NVD →

The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcs_current_currency shortcode in versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fo...

CVSS:

6.4

Affected:

up to 1.1.9

Fixed in:

1.2.0

Disclosed:

May 12, 2023

CVE-2023-2558 on NVD →

The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the anonymous function for the wpcs_sd_delete action in versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscrib...

CVSS:

4.3

Affected:

up to 1.1.9

Fixed in:

1.2.0

Disclosed:

May 12, 2023

CVE-2023-2556 on NVD →

The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save function in versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to...

CVSS:

4.3

Affected:

up to 1.1.9

Fixed in:

1.2.0

Disclosed:

May 12, 2023

CVE-2023-2557 on NVD →

The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the create function in versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level permissions and above, t...

CVSS:

4.3

Affected:

up to 1.1.9

Fixed in:

1.2.0

Disclosed:

May 12, 2023

CVE-2023-2555 on NVD →

[en] Cross-site request forgery (CSRF) vulnerability in WPCS - WordPress Currency Switcher 1.1.6 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

Affected:

up to 1.1.7

Fixed in:

1.1.7

Disclosed:

Jul 7, 2021

CVE-2021-20780 on NVD →

The Currency Switcher plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.6. This is due to missing or incorrect nonce validation on the print_plugin_options() function. This makes it possible for unauthenticated attackers to update the plugin's settings and inject mal...

CVSS:

8.8

Affected:

up to 1.1.6

Fixed in:

1.1.7

Disclosed:

Jul 6, 2021

CVE-2021-20780 on NVD →

Affected:

up to 1.2.0.5

Fixed in:

1.2.0.5

CVE-2025-2169 on NVD →