AA-Team vulnerabilities

🔔 Create alert RSS

Published CVEs affecting AA-Team products: 14 record(s), with severity, exploitation and fixes.

WZone 3 Woocommerce Envato Affiliates 2 Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) 2 Premium Age Verification / Restriction for WordPress 2 Pro Bulk Watermark Plugin for WordPress 1 Responsive Coming Soon Landing Page / Holding Page for WordPress 1 Woocommerce Sales Funnel Builder 1 Wordpress Movies Bulk Importer 1 SearchAzon 1 Amazon Native Shopping Recommendations 1 Premium SEO Pack 1

Exploited only (KEV) →

CVE-2025-49403 High · 7.5 CWE-98 Jun 17, 2026

WordPress Premium Age Verification / Restriction for WordPress Plugin <= 3.0.2 - Arbitrary File Download Vulnerability

Unauthenticated Arbitrary File Download in Premium Age Verification / Restriction for WordPress <= 3.0.2 versions.

CVE-2025-14361 High · 7.1 CWE-862 May 26, 2026

WordPress Woocommerce Envato Affiliates plugin <= 1.2.1 - Settings Change vulnerability

Missing Authorization vulnerability in AA-Team Woocommerce Envato Affiliates allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Woocommerce Envato Affiliates: from n/a through 1.2.1.

CVE-2026-27040 High · 8.8 CWE-22 Mar 25, 2026

WordPress WZone plugin <= 14.0.31 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AA-Team WZone woozone allows Path Traversal.This issue affects WZone: from n/a through <= 14.0.31.

CVE-2026-27039 High · 8.5 CWE-89 Mar 25, 2026

WordPress WZone plugin <= 14.0.31 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team WZone woozone allows Blind SQL Injection.This issue affects WZone: from n/a through <= 14.0.31.

CVE-2026-25473 Medium · 5.4 CWE-862 Feb 19, 2026

WordPress WZone plugin <= 14.0.31 - Broken Access Control vulnerability

Missing Authorization vulnerability in AA-Team WZone woozone allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WZone: from n/a through <= 14.0.31.

CVE-2026-22360 Medium · 4.3 CWE-352 Jan 22, 2026

WordPress SearchAzon plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in AA-Team SearchAzon searchazon allows Cross Site Request Forgery.This issue affects SearchAzon: from n/a through <= 1.4.

CVE-2026-22359 Medium · 4.3 CWE-352 Jan 22, 2026

WordPress Wordpress Movies Bulk Importer plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in AA-Team Wordpress Movies Bulk Importer movies importer allows Cross Site Request Forgery.This issue affects Wordpress Movies Bulk Importer: from n/a through <= 1.0.

CVE-2025-30631 High · 7.1 CWE-79 Jan 6, 2026

Reflected Cross Site Scripting (XSS) vulnerability in AA-Team WordPress plugins

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AA-Team Woocommerce Sales Funnel Builder, AA-Team Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) allows Reflected XSS.This issue affects Woocommerce Sales Funnel Builder: from n/a through 1.1; Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer): from n/a through 1.2.

CVE-2025-29004 High · 8.8 CWE-266 Jan 6, 2026

Privilege Escalation Vulnerability in AA-Team WordPress plugins

Incorrect Privilege Assignment vulnerability in AA-Team Premium Age Verification / Restriction for WordPress, AA-Team Responsive Coming Soon Landing Page / Holding Page for WordPress allows Privilege Escalation.This issue affects Premium Age Verification / Restriction for WordPress: from n/a through 3.0.2; Responsive Coming Soon Landing Page / Holding Page for WordPress: from n/a through 3.0.

CVE-2025-31044 High · 8.5 CWE-89 Jan 5, 2026

WordPress Premium SEO Pack <= 3.3.2 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team Premium SEO Pack allows SQL Injection.This issue affects Premium SEO Pack: from n/a through 3.3.2.

CVE-2025-30633 Critical · 9.3 CWE-89 Jan 5, 2026

WordPress Amazon Native Shopping Recommendations Plugin <= 1.3 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team Amazon Native Shopping Recommendations allows SQL Injection.This issue affects Amazon Native Shopping Recommendations: from n/a through 1.3.

CVE-2025-30628 High · 8.5 CWE-89 Dec 31, 2025

WordPress Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) plugin <= 1.2 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) allows SQL Injection.This issue affects Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer): from n/a through 1.2.

CVE-2025-28973 Medium · 6.5 CWE-35 Dec 31, 2025

WordPress Pro Bulk Watermark Plugin for WordPress <= 2.0 - Path Traversal Vulnerability

Path Traversal: '.../...//' vulnerability in AA-Team Pro Bulk Watermark Plugin for WordPress pro-watermark allows Path Traversal.This issue affects Pro Bulk Watermark Plugin for WordPress: from n/a through <= 2.0.

CVE-2025-53297 High · 7.1 CWE-79 Oct 22, 2025

WordPress Woocommerce Envato Affiliates plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AA-Team Woocommerce Envato Affiliates wooenvato allows Reflected XSS.This issue affects Woocommerce Envato Affiliates: from n/a through <= 1.2.1.