Product Delivery Date For Woocommerce Lite Vulnerabilities

[en] Missing Authorization vulnerability in tychesoftwares Product Delivery Date for WooCommerce – Lite product-delivery-date-for-woocommerce-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Delivery Date for WooCommerce – Lite: from n/a through <= 3.2.0.

Affected:

up to 3.2.0

Fix:

No patched version reported

Disclosed:

Dec 30, 2025

CVE-2025-69027 on NVD →

The Product Delivery Date for WooCommerce – Lite plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 3.2.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized actio...

CVSS:

4.3

Affected:

up to 3.2.0

Fixed in:

3.3.0

Disclosed:

Dec 29, 2025

CVE-2025-69027 on NVD →

[en] Vulnerability in Tyche softwares Product Delivery Date for WooCommerce – Lite.This issue affects Product Delivery Date for WooCommerce – Lite: from n/a through 2.7.0.

Affected:

up to 2.7.1

Fixed in:

2.7.1

Disclosed:

Dec 23, 2025

CVE-2023-52210 on NVD →

[en] The Product Delivery Date for WooCommerce – Lite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.8.0. This makes it possible for unauthenticated attackers to injec...

Affected:

up to 2.8.1

Fixed in:

2.8.1

Disclosed:

Nov 13, 2024

CVE-2024-10882 on NVD →

The Product Delivery Date for WooCommerce – Lite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.8.0. This makes it possible for unauthenticated attackers to inject arb...

CVSS:

6.1

Affected:

up to 2.8.0

Fixed in:

2.8.1

Disclosed:

Nov 12, 2024

CVE-2024-10882 on NVD →

[en] Missing Authorization vulnerability in Tyche Softwares Product Delivery Date for WooCommerce – Lite allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Product Delivery Date for WooCommerce – Lite: from n/a through 2.7.2.

Affected:

up to 2.7.3

Fixed in:

2.7.3

Disclosed:

Nov 1, 2024

CVE-2024-38702 on NVD →

[en] The Product Delivery Date for WooCommerce – Lite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.7.3. This makes it possible for unauthenticated attackers to inject arbitrary web scr...

Affected:

up to 2.7.4

Fixed in:

2.7.4

Disclosed:

Oct 4, 2024

CVE-2024-9345 on NVD →

The Product Delivery Date for WooCommerce – Lite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.7.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts...

CVSS:

6.1

Affected:

up to 2.7.3

Fixed in:

2.7.4

Disclosed:

Oct 3, 2024

CVE-2024-9345 on NVD →

The Product Delivery Date for WooCommerce – Lite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the prdd_lite_update_db_check() function in versions up to, and including, 2.7.2. This makes it possible for unauthenticated attackers to reset tracking.

CVSS:

5.3

Affected:

up to 2.7.2

Fixed in:

2.7.3

Disclosed:

Jul 11, 2024

CVE-2024-38702 on NVD →

The Product Delivery Date for WooCommerce – Lite plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the prdd_delete_all_special_delivery() function in versions up to, and including, 2.7.0. This makes it possible for unauthenticated attackers to delete special deliveries.

CVSS:

5.3

Affected:

up to 2.7.0

Fixed in:

2.7.1

Disclosed:

Jan 3, 2024

CVE-2023-52210 on NVD →