Skip to content
Noroxi

Order Tracking – WordPress Status Tracking Plugin

order-tracking · plugin

Known security vulnerabilities for Order Tracking – WordPress Status Tracking Plugin. Find out in seconds which version runs on your site with WP Lens.

4 known vulnerabilities

2 exploitable without logging in · latest Apr 8, 2026

Listed on wordpress.org · latest 3.5.4 · last updated Aug 20, 2026 · 3K+ installs

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

  • CVE-2024-43343login required≤ 3.3.12

    WordPress Order Tracking – WordPress Status Tracking Plugin plugin < 3.3.13 - Broken Access Control vulnerability

    High 8.8

  • CVE-2023-4471unauthenticated · needs a click≤ 3.3.6

    Order Tracking Pro <= 3.3.6 - Reflected Cross-Site Scripting

    Medium 6.1

  • CVE-2026-39602unauthenticated≤ 3.4.3

    WordPress Order Tracking plugin <= 3.4.3 - Broken Access Control vulnerability

    Medium 5.3

  • CVE-2023-4500admin≤ 3.3.6

    Order Tracking Pro <= 3.3.6 - Authenticated (Administrator+) Stored Cross-Site Scripting

    Medium 4.8

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory