XO
Vendor
Xootix
18
CVEs
0
On KEV
2
New 30D
Products
WW6.5
Waitlist Woocommerce ( Back in stock notifier )
xootix
2 CVEs0 on KEV2 new
LP8.8
Login/signup Popup
Xootix
5 CVEs0 on KEV0 new
SC8.8
Side Cart Woocommerce
Xootix
4 CVEs0 on KEV0 new
WW8.8
Waitlist Woocommerce
Xootix
3 CVEs0 on KEV0 new
OL5.3
OTP Login & Register Woocommerce
xootix
2 CVEs0 on KEV0 new
OL8.8
Otp Login Woocommerce & Gravity Forms
Xootix
2 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-77188 New | WW Waitlist Woocommerce ( Back in stock notifier ) xootix | 6.4 | Oct 28 | Waitlist Woocommerce ( Back in stock notifier ) <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute |
| CVE-2026-114701 New | WW Waitlist Woocommerce ( Back in stock notifier ) xootix | 6.5 | Oct 22 | WordPress Waitlist Woocommerce ( Back in stock notifier ) plugin <= 2.9.1 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-12402 | OL OTP Login & Register Woocommerce xootix | 4.4 | Sep 19 | OTP Login & Register Woocommerce <= 2.7.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'fb-config' Setting |
| CVE-2026-12215 | OL OTP Login & Register Woocommerce xootix | 5.3 | Sep 11 | OTP Login & Register Woocommerce <= 2.7.2 - Unauthenticated Authentication Bypass via Brute Force |
| CVE-2025-1064 | LP Login/signup Popup Xootix | 5.4 | Feb 20 | The Login/Signup Popup ( Inline Form + Woocommerce ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's xoo_el_action shortcode in all versions up… |
| CVE-2024-8724 | WW Waitlist Woocommerce Xootix | 6.1 | Sep 14 | The Waitlist Woocommerce ( Back in stock notifier ) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate… |
| CVE-2024-5665 | LP Login/signup Popup Xootix | 4.3 | Jun 6 | The Login/Signup Popup ( Inline Form + Woocommerce ) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ‘export_settings’… |
| CVE-2024-5324 | SC Side Cart Woocommerce Xootix | 8.8 | Jun 6 | Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the 'import_settings'… |
| CVE-2023-28415 | SC Side Cart Woocommerce Xootix | 4.8 | Aug 30 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in XootiX Side Cart Woocommerce (Ajax) plugin <= 2.2 versions |
| CVE-2020-36715 | LP Login/signup Popup Xootix | 4.6 | Jun 7 | The Login/Signup Popup plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on several functions in versions up to, and including, 1.4 |
| CVE-2022-45376 | SC Side Cart Woocommerce Xootix | 8.8 | May 22 | Cross-Site Request Forgery (CSRF) vulnerability in XootiX Side Cart Woocommerce (Ajax) < 2.1 versions |
| CVE-2023-2706 | OL Otp Login Woocommerce & Gravity Forms Xootix | 8.1 | May 17 | The OTP Login Woocommerce & Gravity Forms plugin for WordPress is vulnerable to authentication bypass |
| CVE-2022-0215 | SC Side Cart Woocommerce Xootix | 8.8 | Jan 18 | The Login/Signup Popup, Waitlist Woocommerce ( Back in stock notifier ), and Side Cart Woocommerce (Ajax) WordPress plugins by XootiX are vulnerable to Cross-Site Request Forgery… |