Flexible Refund for WooCommerce – EU One Click Return

Flexible Refund for WooCommerce – EU One Click Return has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2025 and 2026; all 3 are fixed as of October 2026. Their average CVSS score is 5.3, and the most serious one scores 6.4 out of 10. 2025 was the busiest year with 2 disclosures.

The most common weakness is Authorization Bypass Through User-Controlled Key, behind 1 of the records (33%). Other recurring categories include Cross-Site Scripting, Incorrect Authorization.

Every one of the 3 issues recorded for Flexible Refund for WooCommerce – EU One Click Return has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, most of them (2) reported by Powpy. Flexible Refund for WooCommerce – EU One Click Return is installed on roughly 2,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium
5.3/ 10
Patch Coverage100%
Open

0

Fixed

3

Get automatic notifications for all Flexible Refund for WooCommerce – EU One Click Return vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2026-57402

Flexible Refund for WooCommerce – EU One Click Return <= 1.0.51 - Authenticated (Customer+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

3 records
Flexible Refund for WooCommerce – EU One Click Return banner
Latestv2.1.0

Flexible Refund for WooCommerce – EU One Click Return

wpdesk

Author

wpdesk

4.0(4)
80/100
Last Updated
2026-10-21 (8d ago)
Active Installs
2,000+
Downloads
71,441
Requires WP
6.4+
Requires PHP
7.4+
Tested up to
WP 7.1.3
Created
2022-08-04 (4y ago)
Requires Plugins
woocommerce

Flexible Refund for WooCommerce – EU One Click Return lets you manage customer refund and return requests directly in WooCommerce. Customers can request a refund from My Account → Orders, complete a form, and follow the progress of their request. Store administrators can review submissions, add customer notes, change request statuses, and approve refunds from the order edit screen. Use the form builder to collect return reasons, customer comments, and required confirmations. Add a link to your return policy in email notifications and customize the messages sent during the process. The free version supports full-order refund requests. PRO adds partial refunds, guest forms, separate complaint and repair requests, conditional availability, and automation. Free Plugin Features Refund requests from My Account — let customers start a request from their order history. Full-order refund requests — customers submit all available product quantities for refund. Custom button label — change the text displayed on the refund request button. Refund form builder — collect the information you need to review a return. Five field types — Text, Textarea, Checkbox, Radio, and Select. Field settings — configure labels, descriptions, required answers, options, placeholders, and CSS classes. Text length settings — set minimum and maximum lengths for Text and Textarea answers. Drag-and-drop field ordering — arrange fields to match your return process. Policy confirmations — create required checkboxes for customers to acknowledge your return or privacy policy. Policy page links — select a policy page and include its link in request emails. Shipping cost refunds — exclude shipping, let the customer choose, or include it automatically. Request management in WooCommerce — review submitted products and customer answers from the order edit screen. Request statuses — manage Requested, Shipment, Verifying, Approved, Refused, and Canceled requests. Customer notes — explain decisions and provide instructions. Request cancellation — customers can use Cancel Request in My Account while a request is Requested or Verifying. Request history — keep completed requests and allow another eligible request after the active one ends. Email notifications — notify customers about submissions and status changes, and notify the administrator about new requests. Editable email content — customize messages with order and request placeholders. WooCommerce refunds — approving a refund request creates a WooCommerce refund. Payment gateway refunds depend on the gateway’s refund support. Stock restoration — the refund process asks WooCommerce to restock refunded product quantities. Only one request can be active for an order at a time. Request submission, request approval, and payment reimbursement are separate steps unless PRO automatic approval is enabled. Read the plugin documentation for configuration instructions. PRO Features Extend your return process with Flexible Refund PRO: [PRO] Partial refund requests — let customers select individual products and quantities. [PRO] Reclamation requests — collect product complaints through a separate form. [PRO] Repair requests — provide a dedicated form for repair submissions. [PRO] Separate form settings — configure each request type independently. [PRO] Conditional button visibility — use user roles, order statuses, products, product categories, and payment methods. [PRO] ANY / ALL matching — control how product and category conditions are evaluated. [PRO] Availability periods — limit new requests by hours, days, weeks, months, or years from the order date. [PRO] Automatic approval — approve Refund requests without reviewing each submission manually. [PRO] Refund coupons — generate a WooCommerce coupon after refund approval. [PRO] Additional field types — Multi Select, Upload, and HTML. [PRO] File uploads — collect photos or other attachments, with a configurable file limit. [PRO] Guest request forms — accept requests for guest orders after verifying the order reference and billing email address. [PRO] Separate public shortcodes — publish Refund, Reclamation, and Repair forms. [PRO, from version 2.1.0] Automatic public pages — create missing request pages or assign your own pages. [PRO, from version 2.1.0] Guest status links — let guest customers check a request’s status through an access-key link in an email. [PRO, from version 2.1.0] Navigation reminders — receive notices about public page configuration and adding pages to store navigation. [PRO] Cancel unpaid order button — let customers cancel Pending payment and On hold orders from My Account. [PRO] Editable administrator notification recipients — choose where new request notifications are sent. [PRO] Priority email support. Approving a Reclamation or Repair request completes that request without processing a monetary refund. For orders linked to customer accounts, public request pages direct customers to log in. Explore PRO → Try the Live Demo Explore the customer and administrator workflows in the free demo. Test the available form settings, request management, and email configuration before choosing your setup. What Can You Configure? A return form that collects a reason and additional comments. Required checkboxes for policy acknowledgements. Customer emails explaining the next steps. A process for reviewing, approving, or refusing return requests. Partial refund requests and conditional availability with PRO. Separate complaint and repair forms with PRO. Guest request pages and status access with PRO. Languages The plugin includes English and Polish translations. You can also help translate the free plugin. Documentation View the plugin documentation → Support Get help with the free version through the WordPress.org support forum. PRO includes priority email support and the additional features listed above. Upgrade to PRO → Data use policy Learn about Use of Data Policy by WP Desk Plugins

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C