ShopEngine – All-in-One Elementor WooCommerce Builder with eCommerce Templates & Woo Widgets

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   ShopEngine – All-in-One Elementor WooCommerce Builder with eCommerce Templates & Woo Widgets

Information

Software Type Plugin
Software Slug shopengine (view on wordpress.org)
Software Status Active
Software Author roxnor
Software Website wpmet.com
Software Downloads 1,845,398
Software Active Installs 100,000
Software Record Last Updated October 14, 2026

7 Vulnerabilities

Submit a Vulnerability
The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets <= 4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shopengine_product_title_header_size' Parameter
6.4
CVE-2026-85575
Sep 14, 2026
Researcher: Romain Deperne (ang3L)
ShopEngine Elementor WooCommerce Builder Addon <= 4.9.4 - Authenticated (Shop Manager+) Privilege Escalation to WXR Import '<wp_option>' Nodes
7.2
CVE-2026-75971
Aug 24, 2026
Researcher: Wordfence PRISM
ShopEngine <= 4.9.2 - Cross-Site Request Forgery
4.3
CVE-2026-19088
Aug 11, 2026
Researcher: Farid Narimanov
ShopEngine <= 4.8.5 - Cross-Site Request Forgery to Wishlist Manipulation
4.3
CVE-2025-12358
Dec 2, 2025
Researcher: Adrian Lukita
ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution <= 4.8.4 - Incorrect Authorization to Authenticated (Editor+) License Status Update
2.7
CVE-2025-11888
Oct 24, 2025
Researcher: Jonas Benjamin Friedli
ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution <= 4.8.3 - Insufficient Authorization to Authenticated (Editor+) Settings Update
2.7
CVE-2025-10173
Sep 25, 2025
Researcher: Jonas Benjamin Friedli
ShopEngine <= 4.1.1 - Cross-Site Request Forgery via get_product
5.4
CVE-2022-45371
Apr 19, 2023
Researcher: Muhammad Daffa
Title Status CVE ID CVSS Researchers Date
The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets <= 4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shopengine_product_title_header_size' Parameter Patched CVE-2026-85575 6.4 Romain Deperne (ang3L) September 14, 2026
ShopEngine Elementor WooCommerce Builder Addon <= 4.9.4 - Authenticated (Shop Manager+) Privilege Escalation to WXR Import '<wp_option>' Nodes Patched CVE-2026-75971 7.2 Wordfence PRISM August 24, 2026
ShopEngine <= 4.9.2 - Cross-Site Request Forgery Patched CVE-2026-19088 4.3 Farid Narimanov August 11, 2026
ShopEngine <= 4.8.5 - Cross-Site Request Forgery to Wishlist Manipulation Patched CVE-2025-12358 4.3 Adrian Lukita December 2, 2025
ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution <= 4.8.4 - Incorrect Authorization to Authenticated (Editor+) License Status Update Patched CVE-2025-11888 2.7 Jonas Benjamin Friedli October 24, 2025
ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution <= 4.8.3 - Insufficient Authorization to Authenticated (Editor+) Settings Update Patched CVE-2025-10173 2.7 Jonas Benjamin Friedli September 25, 2025
ShopEngine <= 4.1.1 - Cross-Site Request Forgery via get_product Patched CVE-2022-45371 5.4 Muhammad Daffa April 19, 2023

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation