WordPress plugin
Lucky Wheel for WooCommerce – Spin a Sale security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 2 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High1
- Medium1
- Low0
All Lucky Wheel for WooCommerce – Spin a Sale vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.2 | Authenticated (Administrator+) PHP Code Injection via Conditional Tags ≤1.1.13Update to 1.1.14 | CVE-2025-14509 | |
| Medium6.4 | Cross-Site Scripting ≤1.0.10Update to 1.0.11 | — |
- High7.2Authenticated (Administrator+) PHP Code Injection via Conditional Tags
≤1.1.13Update to 1.1.14
- Medium6.4Cross-Site Scripting
≤1.0.10Update to 1.0.11
Lucky Wheel for WooCommerce – Spin a Sale: common questions
Does Lucky Wheel for WooCommerce – Spin a Sale have known vulnerabilities?
Yes. VulnCrest Radar lists 2 known vulnerabilities in Lucky Wheel for WooCommerce – Spin a Sale: 1 high, 1 medium. None are known to affect version null.
How do I check which version of Lucky Wheel for WooCommerce – Spin a Sale I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Lucky Wheel for WooCommerce – Spin a Sale vulnerability?
CVE-2025-14509, published Dec 29, 2025: Lucky Wheel for WooCommerce – Spin a Sale <= 1.1.13 - Authenticated (Administrator+) PHP Code Injection via Conditional Tags. Severity: High (CVSS 7.2).
Is any Lucky Wheel for WooCommerce – Spin a Sale vulnerability listed in CISA KEV?
No. None of the known Lucky Wheel for WooCommerce – Spin a Sale vulnerabilities is currently listed in the CISA KEV catalog.