Woo Multi Currency Vulnerabilities

The The CURCY – Multi Currency for WooCommerce – Smoothly on WooCommerce 9.x plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.2.14. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortco...

CVSS:

5.4

Affected:

up to 2.2.14

Fixed in:

2.2.15

Disclosed:

Jul 2, 2026

CVE-2026-11778 on NVD →

The The CURCY – Multi Currency for WooCommerce – The best free currency exchange plugin – Run smoothly on WooCommerce 9.x plugin for WordPress is vulnerable to arbitrary shortcode execution via the get_products_price() function in all versions up to, and including, 2.2.5. This is due to the software allowing users to e...

CVSS:

7.3

Affected:

up to 2.2.5

Fixed in:

2.2.6

Disclosed:

Feb 5, 2025

CVE-2024-13487 on NVD →

The CURCY plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a u...

CVSS:

6.1

Affected:

up to 2.2.3

Fixed in:

2.2.4

Disclosed:

Oct 15, 2024

CVE-2024-49283 on NVD →

The CURCY – Multi Currency for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.2.0.1 due to insufficient input sanitization and output escaping on user supplied input. This makes it possible for authenticated attackers with contributor-level and abov...

CVSS:

6.4

Affected:

up to 2.2.0.1

Fixed in:

2.2.1

Disclosed:

Dec 19, 2023

CVE-2023-50831 on NVD →

The CURCY plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'woomulticurrency_exchange' function in versions up to, and including, 2.1.25. This makes it possible for unauthenticated-level attackers to access currency information retrieved by the plugin.

CVSS:

5.3

Affected:

up to 2.1.25

Fixed in:

2.1.26

Disclosed:

Feb 6, 2023

CVE-2022-46796 on NVD →

The CURCY plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in versions up to, and including, 2.1.17. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successf...

CVSS:

6.1

Affected:

up to 2.1.17

Fixed in:

2.1.18

Disclosed:

May 31, 2022

The WooCommerce Multi Currency plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.17. This makes it possible for authenticated attackers to change the price of a product to an arbitrary value.

CVSS:

4.3

Affected:

up to 2.1.17

Fixed in:

2.1.18

Disclosed:

Sep 13, 2021

CVE-2021-4376 on NVD →