WordPress plugin
ShopEngine – All-in-One Elementor WooCommerce Builder with eCommerce Templates & Woo Widgets security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 8 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High1
- Medium5
- Low2
All ShopEngine – All-in-One Elementor WooCommerce Builder with eCommerce Templates & Woo Widgets vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤4.9.8Update to 4.9.9 | CVE-2026-122673 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via 'shopengine_product_title_header_size' Parameter ≤4.9.5Update to 4.9.6 | CVE-2026-85575 | |
| High7.2 | Authenticated (Shop Manager+) Privilege Escalation to WXR Import '<wp_option>' Nodes ≤4.9.4Update to 4.9.5 | CVE-2026-75971 | |
| Medium4.3 | Cross-Site Request Forgery ≤4.9.2Update to 4.9.3 | CVE-2026-19088 | |
| Medium4.3 | Cross-Site Request Forgery to Wishlist Manipulation ≤4.8.5Update to 4.8.6 | CVE-2025-12358 | |
| Low2.7 | Incorrect Authorization to Authenticated (Editor+) License Status Update ≤4.8.4Update to 4.8.5 | CVE-2025-11888 | |
| Low2.7 | Insufficient Authorization to Authenticated (Editor+) Settings Update ≤4.8.3Update to 4.8.4 | CVE-2025-10173 | |
| Medium5.4 | Cross-Site Request Forgery via get_product ≤4.1.1Update to 4.1.2 | CVE-2022-45371 |
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤4.9.8Update to 4.9.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'shopengine_product_title_header_size' Parameter
≤4.9.5Update to 4.9.6
- High7.2Authenticated (Shop Manager+) Privilege Escalation to WXR Import '<wp_option>' Nodes
≤4.9.4Update to 4.9.5
- Medium4.3Cross-Site Request Forgery
≤4.9.2Update to 4.9.3
- Medium4.3Cross-Site Request Forgery to Wishlist Manipulation
≤4.8.5Update to 4.8.6
- Low2.7Incorrect Authorization to Authenticated (Editor+) License Status Update
≤4.8.4Update to 4.8.5
- Low2.7Insufficient Authorization to Authenticated (Editor+) Settings Update
≤4.8.3Update to 4.8.4
- Medium5.4Cross-Site Request Forgery via get_product
≤4.1.1Update to 4.1.2
ShopEngine – All-in-One Elementor WooCommerce Builder with eCommerce Templates & Woo Widgets: common questions
Does ShopEngine – All-in-One Elementor WooCommerce Builder with eCommerce Templates & Woo Widgets have known vulnerabilities?
Yes. VulnCrest Radar lists 8 known vulnerabilities in ShopEngine – All-in-One Elementor WooCommerce Builder with eCommerce Templates & Woo Widgets: 1 high, 5 medium, 2 low. None are known to affect version null.
How do I check which version of ShopEngine – All-in-One Elementor WooCommerce Builder with eCommerce Templates & Woo Widgets I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent ShopEngine – All-in-One Elementor WooCommerce Builder with eCommerce Templates & Woo Widgets vulnerability?
CVE-2026-122673, published Nov 7, 2026: ShopEngine – All-in-One Elementor WooCommerce Builder with eCommerce Templates & Woo Widgets <= 4.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting. Severity: Medium (CVSS 6.4).
Is any ShopEngine – All-in-One Elementor WooCommerce Builder with eCommerce Templates & Woo Widgets vulnerability listed in CISA KEV?
No. None of the known ShopEngine – All-in-One Elementor WooCommerce Builder with eCommerce Templates & Woo Widgets vulnerabilities is currently listed in the CISA KEV catalog.