Xootix vulnerabilities

Products

• Waitlist Woocommerce ( Back In Stock Notifier ) 6
• Login\/signup Popup 5
• Otp Login & Register Woocommerce 5
• Side Cart Woocommerce 4
• Login & Register Customizer – Popup | Slider | Inline | Woocommerce 3
• Side Cart Woocommerce (ajax) 3
• Waitlist Woocommerce 3
• Login/signup Popup 2
• Otp Login Woocommerce \& Gravity Forms 2

Newest

• xootix waitlist woocommerce ( back in stock notifier ) Waitlist Woocommerce ( Back in stock notifier ) <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute CVE-2026-77188 6.4 MediumOctober 28, 2026
• xootix waitlist woocommerce ( back in stock notifier ) WordPress Waitlist Woocommerce ( Back in stock notifier ) plugin <= 2.9.1 - Cross Site Scripting (XSS) vulnerability CVE-2026-114701 6.5 MediumOctober 22, 2026
• unknown otp login & register woocommerce OTP Login & Register Woocommerce < 2.7.3 - Unauthenticated Account Takeover via OTP Brute Force CVE-2026-110135 7.4 HighOctober 16, 2026
• xootix otp login & register woocommerce OTP Login & Register Woocommerce <= 2.7.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'fb-config' Setting CVE-2026-12402 4.4 MediumSeptember 19, 2026
• xootix otp login & register woocommerce OTP Login & Register Woocommerce <= 2.7.2 - Unauthenticated Authentication Bypass via Brute Force CVE-2026-12215 5.3 MediumSeptember 11, 2026
• xootix login/signup popup WordPress Login/Signup Popup plugin <= 2.9.4 - Cross Site Scripting (XSS) Vulnerability CVE-2025-50027 5.9 MediumJune 20, 2025
• xootix login & register customizer – popup | slider | inline | woocommerce, login\/signup popup +1 more Login/Signup Popup ( Inline Form + Woocommerce ) <= 2.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via xoo_el_action Shortcode CVE-2025-1064 6.4 MediumFebruary 20, 2025
• xootix waitlist woocommerce ( back in stock notifier ) WordPress Waitlist Woocommerce plugin <= 2.6 - Broken Access Control vulnerability CVE-2024-43134 4.3 MediumNovember 1, 2024
• xootix waitlist woocommerce ( back in stock notifier ), waitlist woocommerce +1 more Waitlist Woocommerce ( Back in stock notifier ) <= 2.7.5 - Reflected Cross-Site Scripting CVE-2024-8724 6.1 MediumSeptember 14, 2024
• xootix login/signup popup ( inline form + woocommerce ), login\/signup popup +1 more Login/Signup Popup ( Inline Form + Woocommerce ) 2.7.1 - 2.7.2 - Missing Authorization to Arbitrary Options Exposure CVE-2024-5665 4.3 MediumJune 6, 2024
• xootix login & register customizer – popup | slider | inline | woocommerce, login\/signup popup, otp login & register woocommerce +5 more +7 more XootiX Framework <= Various Plugin Versions - Missing Authorization to Arbitrary Options Update CVE-2024-5324 Public exploit 8.8 HighJune 6, 2024
• xootix side cart woocommerce (ajax), side cart woocommerce +1 more WordPress Side Cart Woocommerce (Ajax) Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS) CVE-2023-28415 5.9 MediumAugust 30, 2023
• xootix login & register customizer – popup | slider | inline | woocommerce, login\/signup popup +1 more Login/Signup Popup < 1.5 - Missing Authorization CVE-2020-36715 7.4 HighJune 7, 2023
• xootix side cart woocommerce (ajax), side cart woocommerce +1 more WordPress Side Cart Woocommerce (Ajax) Plugin < 2.1 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2022-45376 4.3 MediumMay 22, 2023
• xootix otp login & register woocommerce, otp login woocommerce \& gravity forms +1 more OTP Login Woocommerce & Gravity Forms <= 2.2 - Authentication Bypass to Privilege Escalation CVE-2023-2706 8.1 HighMay 17, 2023
• xootix login/signup popup, side cart woocommerce (ajax), side cart woocommerce +3 more +5 more XootiX Plugins <= Various Versions Cross-Site Request Forgery to Arbitrary Options Update CVE-2022-0215 8.8 HighJanuary 18, 2022