AA-Team Vulnerabilities and Affected Products
Vulnerabilities associated with Woocommerce Envato Affiliates.
Products
Clear product- WZone9 vulnerabilities
- Premium Age Verification / Restriction for WordPress3 vulnerabilities
- Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer)2 vulnerabilities
- Pro Bulk Watermark Plugin for WordPress2 vulnerabilities
- Woocommerce Envato Affiliates2 vulnerabilities
- Amazon Native Shopping Recommendations1 vulnerability
- Premium SEO Pack1 vulnerability
- Responsive Coming Soon Landing Page / Holding Page for WordPress1 vulnerability
- SearchAzon1 vulnerability
- Woocommerce Sales Funnel Builder1 vulnerability
- Wordpress Movies Bulk Importer1 vulnerability
- WZone – Lite Version1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2025-14361HIGH | WordPress Woocommerce Envato Affiliates plugin <= 1.2.1 - Settings Change vulnerabilityMissing Authorization vulnerability in AA-Team Woocommerce Envato Affiliates allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Woocommerce Envato Affiliates: from n/a through 1.2.1. CWE-862May 26, 2026 | CVSS7.1v3.1 | EPSS0.248% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-53297HIGH | WordPress Woocommerce Envato Affiliates plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AA-Team Woocommerce Envato Affiliates wooenvato allows Reflected XSS.This issue affects Woocommerce Envato Affiliates: from n/a through <= 1.2.1. CWE-79Oct 22, 2025 | CVSS7.1v3.1 | EPSS0.219% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |