CVE-2023-5325

The Woocommerce Vietnam Checkout WordPress plugin before 2.0.6 does not escape the custom shipping phone field no the checkout form leading to XSS...

Cross site scripting

The Woocommerce Vietnam Checkout WordPress plugin before 2.0.6 does not escape the custom shipping phone field no the checkout form leading to XSS...

CVE-2023-5325 Woocommerce Vietnam Checkout < 2.0.6 - Unauthenticated Stored XSS

The Woocommerce Vietnam Checkout WordPress plugin before 2.0.6 does not escape the custom shipping phone field no the checkout form leading to XSS...

CVE-2023-5325

CVE-2023-5325 affects the WooCommerce Vietnam Checkout WordPress plugin prior to version 2.0.6. The root cause is lack of escaping/cleanup of the custom shipping phone field on the checkout form, causing unauthenticated stored XSS. Public PoC details and descriptions across multiple sources confi...

WordPress plugin Woocommerce Vietnam Checkout security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

PT-2023-23579 · Unknown · Orocommerce

Name of the Vulnerable Software and Affected Versions: OroCommerce versions prior to 5.0.11 OroCommerce versions prior to 5.1.1 Description: The issue allows detailed order totals information to be received by Order ID, and detailed checkout totals information may be received by Checkout ID...

PT-2023-32044 · WordPress · Woocommerce Vietnam Checkout

Name of the Vulnerable Software and Affected Versions: WooCommerce Vietnam Checkout WordPress plugin versions prior to 2.0.6 Description: The issue concerns the WooCommerce Vietnam Checkout WordPress plugin, where the custom shipping phone field on the checkout form is not properly escaped, leadi...

Checkout Field Editor < 1.7.5 - Cross-Site Request Forgery to Checkout Fields Update

Description The Checkout Field Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.4. This is due to missing nonce validation when updating checkout fields. This makes it possible for unauthenticated attackers to update checkout fields via...

CVE-2023-47309

Nukium nkmgls before version 3.0.2 is vulnerable to Cross Site Scripting XSS via NkmGlsCheckoutModuleFrontController::displayAjaxSavePhoneMobile...

CVE-2023-47657

Auth. ShopManager+ Stored Cross-Site Scripting XSS vulnerability in GrandPlugins Direct Checkout – Quick View – Buy Now For WooCommerce plugin = 1.5.8 versions...

CVE-2023-47657

Auth. ShopManager+ Stored Cross-Site Scripting XSS vulnerability in GrandPlugins Direct Checkout – Quick View – Buy Now For WooCommerce plugin = 1.5.8 versions...

WordPress Plugin Direct Checkout - Quick View - Buy Now For WooCommerce Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. WordPress Plugin Direct Checkout -...

CVE-2023-47657

CVE-2023-47657 affects GrandPlugins Direct Checkout – Quick View – Buy Now For WooCommerce plugin up to version 1.5.8. It is a Stored XSS vulnerability exploitable by an authenticated user with Shop Manager+ privileges. Patch status: fixed in 1.5.9 (per Patchstack); NVD lists CVSSv3.1 base 4.8 (m...

PT-2023-30543 · Grandplugins · Grandplugins Direct Checkout – Quick View – Buy Now For Woocommerce

Name of the Vulnerable Software and Affected Versions: GrandPlugins Direct Checkout – Quick View – Buy Now For WooCommerce plugin versions = 1.5.8 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability can be exploited by an authenticated user wit...

WordPress WooCommerce Checkout Manager Plugin <= 7.3.0 is vulnerable to Broken Access Control

Software WooCommerce Checkout Manager Type Plugin Vulnerable versions = 7.3.0 Fixed in 7.3.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-47681 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID b9559fa71258 Credits Rafie Muhammad...

Woocommerce Vietnam Checkout < 2.0.6 - Unauthenticated Stored XSS

Description The plugin does not escape the custom shipping phone field no the checkout form leading to XSS 1 Install both WooCommerce and the plugin. 2 Set a WooCommerce shipping method, and the store's address to one that is in Vietnam. 3 Add product to cart, and proceed to checkout 4 Tick "Ship...

CVE-2023-45384

KnowBand supercheckout 5.0.7 and 6.0.7 is vulnerable to Unrestricted Upload of File with Dangerous Type. In the module "Module One Page Checkout, Social Login & Mailchimp" supercheckout, a guest can upload files with extensions .php...

CVE-2023-45384

KnowBand supercheckout 5.0.7 and 6.0.7 is vulnerable to Unrestricted Upload of File with Dangerous Type. In the module "Module One Page Checkout, Social Login & Mailchimp" supercheckout, a guest can upload files with extensions .php...

CVE-2023-45384

KnowBand supercheckout 5.0.7 and 6.0.7 is vulnerable to Unrestricted Upload of File with Dangerous Type. In the module "Module One Page Checkout, Social Login & Mailchimp" supercheckout, a guest can upload files with extensions .php...

CVE-2023-45384

KnowBand supercheckout 5.0.7 and 6.0.7 is vulnerable to Unrestricted Upload of File with Dangerous Type. In the module "Module One Page Checkout, Social Login & Mailchimp" supercheckout, a guest can upload files with extensions .php...