WordPress FunnelKit Checkout Plugin <= 3.10.3 is vulnerable to Arbitrary Content Deletion

Software FunnelKit Checkout Type Plugin Vulnerable versions = 3.10.3 Fixed in 3.11.0 OWASP Top 10 A1: Broken Access Control Classification Arbitrary Content Deletion CVE CVE-2023-51672 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 02d122ae661d Credits Dave Jong...

WordPress FunnelKit Checkout Plugin <= 3.10.3 is vulnerable to Settings Change

Software FunnelKit Checkout Type Plugin Vulnerable versions = 3.10.3 Fixed in 3.11.0 OWASP Top 10 A1: Broken Access Control Classification Settings Change CVE CVE-2023-51670 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID f342e4f6141d Credits Dave Jong Patchstack Required...

WordPress FunnelKit Checkout Plugin <= 3.10.3 is vulnerable to Settings Change

Software FunnelKit Checkout Type Plugin Vulnerable versions = 3.10.3 Fixed in 3.11.0 OWASP Top 10 A1: Broken Access Control Classification Settings Change CVE CVE-2023-51671 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID f63332e6c6a9 Credits Dave Jong Patchstack Required...

WordPress Checkout Mestres WP Plugin <= 7.1.9.7 is vulnerable to SQL Injection

Software Checkout Mestres WP Type Plugin Vulnerable versions = 7.1.9.7 Fixed in 7.1.9.8 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2023-51469 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 3f69879bcd0c Credits Rafie Muhammad Patchstack Required...

WordPress Checkout Mestres WP Plugin <= 7.1.9.7 is vulnerable to Settings Change

Software Checkout Mestres WP Type Plugin Vulnerable versions = 7.1.9.7 Fixed in 7.1.9.8 OWASP Top 10 A1: Broken Access Control Classification Settings Change CVE CVE-2023-51471 Patch priority High CVSS severity High 8.2 Developer Claim ownership PSID cfce7b38ed64 Credits Rafie Muhammad Patchstack...

WordPress Checkout Mestres WP Plugin <= 7.1.9.7 is vulnerable to Privilege Escalation

Software Checkout Mestres WP Type Plugin Vulnerable versions = 7.1.9.7 Fixed in 7.1.9.8 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2023-51472 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 9fb8ab95cc18 Credits...

CVE-2023-7075

A vulnerability was found in code-projects Point of Sales and Inventory Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /main/checkout.php. The manipulation of the argument pt leads to cross site scripting. The attack may be...

PT-2023-32861 · Code Projects · Point Of Sales/Inventory Management System

Name of the Vulnerable Software and Affected Versions: code-projects Point of Sales and Inventory Management System version 1.0 Description: A vulnerability was found in the system, classified as problematic. It affects some unknown functionality of the file /main/checkout.php. The manipulation o...

Flexible Woocommerce Checkout Field Editor <= 2.0.1 - Missing Authorization

Description The Flexible Woocommerce Checkout Field Editor plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on an unknown function function in versions up to, and including, 2.0.1. This makes it possible for unauthenticated attackers to perform an...

Business Logic Errors

microweber is vulnerable for Business Logic Errors. The vulnerability is due to the get function in CartManager.php lacking a check for whether the content items are unpublished or deleted before they are processed for checkout...

Microweber Business Logic Errors

Business Logic Errors in GitHub repository microweber/microweber prior to 2.0.0. Unpublished and deleted products can be added to checkout...

GHSA-3RPX-PGMF-J96H Microweber Business Logic Errors

Business Logic Errors in GitHub repository microweber/microweber prior to 2.0.0. Unpublished and deleted products can be added to checkout...

PT-2023-32695 · Unknown · Microweber

Name of the Vulnerable Software and Affected Versions: microweber/microweber versions prior to 2.0 Description: The issue concerns Business Logic Errors in the microweber/microweber GitHub repository. Unpublished and deleted products can be added to checkout, indicating a flaw in the application'...

WordPress Flexible Woocommerce Checkout Field Editor Plugin <= 2.0.1 is vulnerable to Broken Access Control

Software Flexible Woocommerce Checkout Field Editor Type Plugin Vulnerable versions = 2.0.1 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-49817 Patch priority High CVSS severity High 8.2 Developer Claim ownership PSID 7f56403bf8aa Credits Ab...

OroCommerce get-totals-for-checkout API endpoint returns unwanted data

Detailed Checkout totals information may be received by Checkout ID...

GHSA-88G2-XGH9-4PH2 OroCommerce get-totals-for-checkout API endpoint returns unwanted data

Detailed Checkout totals information may be received by Checkout ID...

CVE-2023-5325

The Woocommerce Vietnam Checkout WordPress plugin before 2.0.6 does not escape the custom shipping phone field no the checkout form leading to XSS...

CVE-2023-5325

The Woocommerce Vietnam Checkout WordPress plugin before 2.0.6 does not escape the custom shipping phone field no the checkout form leading to XSS...

Cross site scripting

The Woocommerce Vietnam Checkout WordPress plugin before 2.0.6 does not escape the custom shipping phone field no the checkout form leading to XSS...

CVE-2023-5325 Woocommerce Vietnam Checkout < 2.0.6 - Unauthenticated Stored XSS

The Woocommerce Vietnam Checkout WordPress plugin before 2.0.6 does not escape the custom shipping phone field no the checkout form leading to XSS...