Plugins · woocommerce-currency-switcher · data as of 2026-11-04
Is FOX safe? Known vulnerabilities and latest version
- Latest version
- 1.5.6
- Last updated
- 2026-10-24
- Active installs
- 50,000+
- Known issues on record
- 13
- Unpatched in latest
- 0
- Tested up to WP
- 7.1.4 · PHP 7.4+
FOX - Currency Switcher Professional for WooCommerce (former name is WOOCS) is currency plugin for woocommerce and multi currency shop, switch & pay — by RealMag777
What to do
- Update to the latest version (1.5.6). Anything older than 1.5.5 has at least one known issue listed below. Dashboard → Updates, or Plugins → “update now”.
- If you cannot update right away, deactivate it until you can.
- Turn on auto-updates for it: Plugins → “Enable auto-updates” on its row.
- If you ran a vulnerable version and something looks off (spam pages, strange admins, redirects), run the free scan.
With WP-CLI: wp plugin get woocommerce-currency-switcher --field=version shows what you run; wp plugin update woocommerce-currency-switcher updates it.
Check your version
Known vulnerabilities
13 on record, newest first. “Affected” is the version range the source gives; “fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version.
medium 5.3 CVE-2026-108174 · published 2026-10-13
Missing authorization check in FOX (1.5.4 and older)
- Affected
- 1.5.4 and older
- Fixed in
- 1.5.5
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by Patchstack
Details from the advisory
Missing Authorization vulnerability in PluginUs.Net FOX woocommerce-currency-switcher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FOX: from n/a through 1.5.4.
high 7.1 CVE-2026-57319 · published 2026-06-26
Cross-site scripting (XSS) in FOX (1.4.8 and older)
- Affected
- 1.4.8 and older
- Fixed in
- 1.4.9
- Access needed (per CVSS)
- No login needed; someone on the site has to click a link or open a page
- Range from
- CVE record (the advisory publisher) · score by Patchstack
Details from the advisory
Unauthenticated Cross Site Scripting (XSS) in FOX <= 1.4.8 versions.
medium 4.3 CVE-2026-9241 · published 2026-05-28
Missing authorization check in FOX (1.4.6 and older)
- Affected
- 1.4.6 and older
- Fixed in
- 1.4.8 *
- Access needed (per CVSS)
- Needs a low-level account (e.g. subscriber)
- Range from
- CVE record (the advisory publisher) · score by Wordfence
Details from the advisory
The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and including 1.4.6. This is due to the `get_value()` function in `classes/fixed/fixed_user_role.php` trusting the attacker-controlled `$_REQUEST['wooc_order_user_roles']` parameter to determine the user's role context for role-based price resolution without any validation, allowing it to override the legitimate role data derived from the authenticated user's session object via `$user->roles`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to impersonate higher-privileged roles — such as wholesale customer or administrator — and obtain discounted or otherwise restricted pricing that should not be available to their actual role. This vulnerability only has practical impact when the fixed user-role pricing feature is enabled and at least one product has a privileged-role price configured.
NVD CVE-2026-9241Wordfence advisoryCode change (fix)Plugin source
high 8.1 CVE-2026-4094 · published 2026-05-15
Cross-site request forgery (CSRF) in FOX (1.4.5 and older)
- Affected
- 1.4.5 and older
- Fixed in
- 1.4.8 *
- Access needed (per CVSS)
- Needs a low-level account (e.g. subscriber)
- Range from
- CVE record (the advisory publisher) · score by Wordfence
Details from the advisory
The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check on the 'admin_head' function in all versions up to, and including, 1.4.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete the entire multi-currency configuration by visiting any wp-admin page with the `woocs_reset` parameter appended. Additionally, because no nonce is verified, this is also exploitable via Cross-Site Request Forgery against any administrator. The vulnerability may also be exploited by Subscriber-level users if the site is configured to allow Subscriber access to 'wp-admin' pages.
NVD CVE-2026-4094Wordfence advisoryCode change (fix)Plugin source
high 7.6 CVE-2026-39497 · published 2026-04-08
SQL injection in FOX (1.4.5 and older)
- Affected
- 1.4.5 and older
- Fixed in
- 1.4.6
- Access needed (per CVSS)
- Needs an admin-level account
- Range from
- CVE record (the advisory publisher) · score by Patchstack
Details from the advisory
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 FOX woocommerce-currency-switcher allows Blind SQL Injection.This issue affects FOX: from n/a through <= 1.4.5.
medium 5.3 CVE-2026-39501 · published 2026-04-08
Missing authorization check in FOX (1.4.5 and older)
- Affected
- 1.4.5 and older
- Fixed in
- 1.4.6
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by Patchstack
Details from the advisory
Missing Authorization vulnerability in RealMag777 FOX woocommerce-currency-switcher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FOX: from n/a through <= 1.4.5.
high 7.3 CVE-2024-10640 · published 2024-11-09
Remote code execution in FOX (1.4.2.2 and older)
- Affected
- 1.4.2.2 and older
- Fixed in
- 1.4.8 *
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by Wordfence
Details from the advisory
The The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.4.2.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
high 7.3 CVE-2024-8271 · published 2024-09-14
Remote code execution in FOX (1.4.2.1 and older)
- Affected
- 1.4.2.1 and older
- Fixed in
- 1.4.8 *
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by NVD
Details from the advisory
The The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.4.2.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode in the 'woocs_get_custom_price_html' function. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
NVD CVE-2024-8271Wordfence advisoryCode change (fix)Plugin source
medium 6.5 CVE-2024-3734 · published 2024-05-02
Remote code execution in FOX (1.4.1.8 and older)
- Affected
- 1.4.1.8 and older
- Fixed in
- 1.4.2 *
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by Wordfence
Details from the advisory
The FOX – Currency Switcher Professional for WooCommerce plugin is vulnerable to Unauthenticated Arbitrary Shortcode Execution in versions up to, and including, 1.4.1.8. This allows unauthenticated attackers to execute arbitrary shortcodes. The severity and exploitability depends on what other plugins are installed and what shortcode functionality they provide.
NVD CVE-2024-3734Wordfence advisoryCode change (fix)Plugin source
high 8.8 CVE-2024-30458 · published 2024-03-29
Cross-site request forgery (CSRF) in FOX (1.4.1.7 and older)
- Affected
- 1.4.1.7 and older
- Fixed in
- 1.4.1.8
- Access needed (per CVSS)
- No login needed; someone on the site has to click a link or open a page
- Range from
- CVE record (the advisory publisher) · score by NVD
Details from the advisory
Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WOOCS – WooCommerce Currency Switcher.This issue affects WOOCS – WooCommerce Currency Switcher: from n/a through 1.4.1.7.
medium 5.4 CVE-2023-6556 · published 2024-01-11
Stored cross-site scripting (XSS) in FOX (1.4.1.6 and older)
- Affected
- 1.4.1.6 and older
- Fixed in
- 1.4.2 *
- Access needed (per CVSS)
- Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
- Range from
- CVE record (the advisory publisher) · score by NVD
Details from the advisory
The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via currency options in all versions up to, and including, 1.4.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD CVE-2023-6556Wordfence advisoryCode change (fix)Plugin source
high 8.8 CVE-2023-49834 · published 2023-12-17
Cross-site request forgery (CSRF) in FOX (1.4.1.4 and older)
- Affected
- 1.4.1.4 and older
- Fixed in
- 1.4.1.5
- Access needed (per CVSS)
- No login needed; someone on the site has to click a link or open a page
- Range from
- CVE record (the advisory publisher) · score by NVD
Details from the advisory
Cross-Site Request Forgery (CSRF) vulnerability in realmag777 FOX – Currency Switcher Professional for WooCommerce.This issue affects FOX – Currency Switcher Professional for WooCommerce: from n/a through 1.4.1.4.
medium 6.1 CVE-2021-25043 · published 2022-01-10
Reflected cross-site scripting (XSS) in FOX (older than 1.3.7.3)
- Affected
- older than 1.3.7.3
- Fixed in
- 1.3.7.3
- Access needed (per CVSS)
- No login needed; someone on the site has to click a link or open a page
- Range from
- NVD analysis · score by NVD
Details from the advisory
The WOOCS WordPress plugin before 1.3.7.3 does not sanitise and escape the custom_prices parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue
Recent activity
- 2026-10-24 — latest release on wordpress.org (1.5.6).
- 2026-10-13 — Missing authorization check disclosed (CVE-2026-108174), fixed in 1.5.5.
- 2026-06-26 — Cross-site scripting (XSS) disclosed (CVE-2026-57319), fixed in 1.4.9.
- 2026-05-28 — Missing authorization check disclosed (CVE-2026-9241), fixed in 1.4.8.
Get an email when FOX has a new vulnerability
Free. We check the CVE feeds every day and email you only when a new issue for FOX (woocommerce-currency-switcher) is published or a fix ships. Unsubscribe in one click.
Browse vulnerabilities
- Published this week
- Unpatched in the latest version
- By type of vulnerability
- Plugins by RealMag777 (10 tracked)
Types found in this plugin: Missing authorization (3) · Cross-site scripting (XSS) (3) · Cross-site request forgery (CSRF) (3) · Remote code execution (3) · SQL injection (1)
Where this data comes from
- Version, last update, installs: wordpress.org/plugins/woocommerce-currency-switcher (Plugins API), fetched 2026-11-04.
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Each record links to its CVE page and to the original advisory (Wordfence, Patchstack or WPScan) where there is one. We only list a CVE here when its references or its advisory name this exact plugin, so a few real issues may be missing; none should be about a different plugin. Spot an error? Email Daniel.
Badge for your site or docs (states facts with a date, not a verdict):
<a href="https://laskyr.com/plugins/woocommerce-currency-switcher"><img src="https://laskyr.com/plugins/woocommerce-currency-switcher/badge.svg" alt="FOX vulnerability status"></a>