WordPress security by component

StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More

Plugin description

StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More is a WordPress component with 2 published CVE records in this archive. The latest tracked vulnerability was published Sep 17, 2025; the highest CVE/CNA score is 8.8.

Plugin slug: storeengine

Latest vulnerability

CVE-2025-9216: StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More: Dangerous file upload

StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More is affected by dangerous file upload. Exploitation requires at least subscriber-level access. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.

PublishedSep 17, 2025

Safe version guidanceSee mitigation notes

		Safe version
Sep 17, 2025	CVE-2025-9216 StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More: Dangerous file upload StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More is affected by dangerous file upload. Exploitation requires at least subscriber-level access. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.	See mitigation notes	CVE8.8 NVDPending
Sep 17, 2025	CVE-2025-9215 StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More: Filesystem traversal StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More is affected by filesystem traversal. Exploitation requires at least subscriber-level access. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.	See mitigation notes	CVE6.5 NVDPending