Woolementor Vulnerabilities

The CoDesigner plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 4.30. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

CVSS:

5.4

Affected:

up to 4.30

Fixed in:

4.31

Disclosed:

Sep 22, 2025

CVE-2025-57961 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codexpert, Inc CoDesigner WooCommerce Builder for Elementor allows Stored XSS.This issue affects CoDesigner WooCommerce Builder for Elementor: from n/a through 4.7.17.2.

Affected:

up to 4.14

Fix:

No patched version reported

Disclosed:

Jan 15, 2025

CVE-2025-22788 on NVD →

The CoDesigner WooCommerce Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.21 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrar...

CVSS:

6.4

Affected:

up to 4.21

Fix:

No patched version reported

Disclosed:

Jan 13, 2025

CVE-2025-22788 on NVD →

[en] The CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.4.1 via deserialization of untrusted input from the recently_viewed_products cookie. This makes it possible for unau...

Affected:

up to 4.5

Fixed in:

4.5

Disclosed:

Jun 13, 2024

CVE-2024-4371 on NVD →

The CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.4.1 via deserialization of untrusted input from the recently_viewed_products cookie. This makes it possible for unauthent...

CVSS:

9

Affected:

up to 4.4.1

Fixed in:

4.5

Disclosed:

Jun 12, 2024

CVE-2024-4371 on NVD →

[en] The CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Shop Slider, Tabs Classic, and Image Comparison widgets in all versions up to, and including, 4.4.1 due to insufficient input saniti...

Affected:

up to 4.5

Fixed in:

4.5

Disclosed:

Jun 12, 2024

CVE-2024-4564 on NVD →

The CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Shop Slider, Tabs Classic, and Image Comparison widgets in all versions up to, and including, 4.4.1 due to insufficient input sanitizatio...

CVSS:

6.4

Affected:

up to 4.4.1

Fixed in:

4.5

Disclosed:

Jun 11, 2024

CVE-2024-4564 on NVD →