Threat Entry Updated 2025-07-10

CVE-2025-5103 - Woo Gift Cards Lite Plugin

The Ultimate Gift Cards for WooCommerce plugin for WordPress is vulnerable to boolean-based SQL Injection via the 'default_price' and 'product_id' parameters in all versions up to, and including, 3.1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

PLUGIN Woo Gift Cards Lite

CVE-2025-5103

MEDIUM CVSS 4.9 2025-06-03

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-04-08

CVE-2021-4391 - Woo Gift Cards Lite Plugin

The Ultimate Gift Cards for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1.1. This is due to missing or incorrect nonce validation on the mwb_wgm_save_post() function. This makes it possible for unauthenticated attackers to modify product gift card details via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

PLUGIN Woo Gift Cards Lite

CVE-2021-4391

MEDIUM CVSS 4.3 2023-07-01

Risk Score

Open Full Technical Breakdown