Small Package Quotes – Worldwide Express Edition

Small Package Quotes – Worldwide Express Edition has 5 disclosed vulnerabilities in the WordSec catalog, all reported in 2025; all 5 are fixed as of September 2026. Their average CVSS score is 6.8, and the most serious one scores 7.5 out of 10. Severity breakdown: 0 critical and 3 high. 2025 was the busiest year with 5 disclosures.

The most common weakness is SQL Injection, behind 3 of the records (60%). Other recurring categories include Cross-Site Scripting, Missing Authorization.

Every one of the 5 issues recorded for Small Package Quotes – Worldwide Express Edition has a vendor fix available, so running the current release closes all known holes.

4 independent researchers contributed these findings, most of them (2) reported by Colin Xu. Small Package Quotes – Worldwide Express Edition is installed on roughly 90 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium

6.8/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Small Package Quotes – Worldwide Express Edition vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.5CVE-2025-27268

Small Package Quotes – Worldwide Express Edition <= 5.2.18 - Unauthenticated SQL Injection

Read the full analysis

Vulnerability Records

5 records


2025-04-03 00:00	Small Package Quotes – Worldwide Express Edition <= 5.2.19 - Missing Authorization Small Package Quotes <= 5.2.19	`CVE-2025-30915`	5.3 Medium	Kévin Mosbahi (Mika)	Yes
2025-04-01 00:00	Small Package Quotes – Worldwide Express Edition <= 5.2.18 - Reflected Cross-Site Scripting Small Package Quotes <= 5.2.18	`CVE-2025-31078`	6.1 Medium	Trương Hữu Phúc (truonghuuphuc)	Yes
2025-02-21 00:00	Small Package Quotes – Worldwide Express Edition <= 5.2.18 - Unauthenticated SQL Injection Small Package Quotes <= 5.2.18	`CVE-2025-27268`	7.5 High	LVT-tholv2k	Yes
2025-02-18 21:44	Small Package Quotes – Worldwide Express Edition <= 5.2.18 - Unauthenticated SQL Injection Small Package Quotes <= 5.2.18	`CVE-2024-13534`	7.5 High	Colin Xu	Yes
2025-01-18 00:00	Small Package Quotes – Worldwide Express Edition <= 5.2.17 - Unauthenticated SQL Injection Small Package Quotes <= 5.2.17	`CVE-2025-24667`	7.5 High	Colin Xu	Yes

Showing 1–5 of 5 reports

Latestv5.3.15

Small Package Quotes – Worldwide Express Edition

Author

enituretechnology

5.0(1)

100/100

Last Updated

2026-08-25 (19d ago)

Active Installs

90+

Downloads

14,985

Requires WP

6.4+

Requires PHP

Tested up to

WP 7.1

Created

2016-05-05 (11y ago)

Requires Plugins

woocommerce

Worldwide Express (wwex.com ) is a third party logistics company that gives its customers access to UPS and over 60 LTL freight carriers through a single account relationship. The plugin retrieves the UPS rates you negotiated Worldwide Express, takes action on them according to the plugin settings, and displays the result as shipping charges in your WooCommerce shopping cart. To establish a Worldwide Express account call 1-800-758-7447. Key Features Includes negotiated shipping rates in the shopping cart and on the checkout page. Ability to control which UPS small package services to display Support for variable products. Option to include residential delivery surcharge Option to mark up shipping rates by a set dollar amount or by a percentage. Requirements WooCommerce 6.4 or newer. A Worldwide Express account number. Your username and password to Worldwide Express’s online shipping system. Your Worldwide Express web services authentication key. An API key from Eniture Technology.

View on WordPress.org