DRUPAL-CONTRIB-2020-020

Drupal Commerce is used to build eCommerce websites and applications. It's possible to configure commerce to permit orders by anonymous users. In this configuration, customers who do not choose to create an account upon checkout completion remain anonymous, and the resulting orders are never...

CVE-2020-12279

An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkout.c mishandles equivalent filenames that exist because of NTFS short names. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1353...

Klarna Checkout for WooCommerce < 2.0.10 - Authenticated Arbitrary Plugin Deactivation, Activation and Installation

The plugin registers one AJAX action intended for installing addon plugins from WordPress.org. The callback method to this action does not have a capability nor nonce check. This enables any logged in user to post a request to the endpoint and install, activate or deactivate any plugin. Since the...

Klarna Checkout for WooCommerce < 2.0.10 - Authenticated Arbitrary Plugin Deactivation, Activation and Installation

The plugin registers one AJAX action intended for installing addon plugins from WordPress.org. The callback method to this action does not have a capability nor nonce check. This enables any logged in user to post a request to the endpoint and install, activate or deactivate any plugin. Since the...

Online Credit Card Skimmers Are Thriving During the Pandemic

As brick and mortars close due to the novel coronavirus, thieves have increasingly targeted digital checkout...

TrueFire Guitar Tutoring Website Suffers Magecart-style Credit Card Breach

Online guitar tutoring website TrueFire has apparently suffered a 'Magecart' style data breach incident that may have potentially led to the exposure of its customers' personal information and payment card information. TrueFire is one of the popular guitar tutoring websites with over 1 million...

VulnCheck KEV: CVE-2020-36731

The Flexible Checkout Fields for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Arbitrary Plugin Settings update, in addition to Stored Cross-Site Scripting in versions up to, and including, 2.3.1. This is due to missing authorization checks on the updateSettingsAction function...

Flexible Checkout Fields for WooCommerce < 2.3.2 - Unauthenticated Settings Update

According to various sources, the plugin was being actively exploited in the wild, injecting scripts into the WooCommerce checkout pages...

CVE-2020-7964

An issue was discovered in Mirumee Saleor 2.x before 2.9.1. Incorrect access control in the checkoutCustomerAttach mutations allows attackers to attach their checkouts to any user ID and consequently leak user data e.g., name, address, and previous orders of any other customer...

PT-2020-19880

Name of the Vulnerable Software and Affected Versions Mirumee Saleor versions prior to 2.9.1 Description The issue is related to incorrect access control in the checkoutCustomerAttach mutations, allowing attackers to attach their checkouts to any user id and leak user data, such as name, address,...

WordPress Swipe Checkout for WP e-Commerce Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Swipe Checkout for WP e-Commerce is an online payment plugin for e-commerce sites. A cross-site scripting vulnerability exists in...

WordPress Swipe Checkout for WooCommerce Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Swipe Checkout for WooCommerce is a payment plugin for e-commerce used in it. A cross-site scripting vulnerability exists in the...

CVE-2014-4558

Cross-site scripting XSS vulnerability in test-plugin.php in the Swipe Checkout for WooCommerce plugin 2.7.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the apiurl parameter...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in test-plugin.php in the Swipe Checkout for WP e-Commerce plugin 3.1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 apikey, 2 paymentpageurl, 3 merchantid, 4 apiurl, or 5 currency parameter...

CVE-2014-4559

Multiple cross-site scripting XSS vulnerabilities in test-plugin.php in the Swipe Checkout for WP e-Commerce plugin 3.1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 apikey, 2 paymentpageurl, 3 merchantid, 4 apiurl, or 5 currency parameter...

CVE-2014-4559

CVE-2014-4559 is an XSS vulnerability in the Swipe Checkout for WP e-Commerce plugin (WordPress) affecting test-plugin.php, version 3.1.0 and earlier. The issue allows remote injection of arbitrary script/HTML via the parameters api_key, payment_page_url, merchant_id, api_url, or currency. Connec...

CVE-2014-4558: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in test-plugin.php in the Swipe Checkout for WooCommerce plugin 2.7.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the apiurl parameter...

CVE-2014-4559: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in test-plugin.php in the Swipe Checkout for WP e-Commerce plugin 3.1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 apikey, 2 paymentpageurl, 3 merchantid, 4 apiurl, or 5 currency parameter...

PT-2019-7118

Name of the Vulnerable Software and Affected Versions Swipe Checkout for WP e-Commerce plugin versions 3.1.0 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML via the api key, payment page url, merchant id, api url, or currency parameter in the...

PT-2019-7117

Name of the Vulnerable Software and Affected Versions Swipe Checkout for WooCommerce plugin versions 2.7.1 and earlier Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the api url parameter. Recommendations For Swipe Checkout for...