CVE-2021-24846

The getquery function of the Ni WooCommerce Custom Order Status WordPress plugin before 1.9.7, used by the niwoocosajax AJAX action, available to all authenticated users, does not properly sanitise the sort parameter before using it in a SQL statement, leading to an SQL injection, exploitable by...

PT-2024-17270

Name of the Vulnerable Software and Affected Versions Additional Custom Order Status for WooCommerce plugin for WordPress versions up to, and including, 1.6.0 Description The issue is related to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows...

CVE-2024-11814: Improper Neutralization of Input During Web Page Generation

The Additional Custom Order Status for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the wfwpwcosdeletefinished, wfwpwcosdeletefallbackfinished, wfwpwcosdeletefallbackordersupdated, and wfwpwcosdeletefallbackstatus parameters in all versions up to, and...

WordPress Additional Custom Order Status for WooCommerce plugin <= 1.6.0 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin Additional Custom Order Status for WooCommerce versions = 1.6.0...

WordPress Custom Order Status Per Product for WooCommerce plugin <= 1.6.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Custom Order Status Per Product for WooCommerce plugin versions = 1.6.1. Solution No patched version available...

WordPress Custom Order Status Per Product for WooCommerce plugin <= 1.6.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Custom Order Status Per Product for WooCommerce plugin versions = 1.6.1. Solution No patched version available...

WordPress Ni WooCommerce Custom Order Status plugin SQL injection vulnerability

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.A SQL injection vulnerability exists in the WordPress Ni WooCommerce Custom Order Status plugin, which stems fro...

CVE-2021-24846

The CVE-2021-24846 issue affects the WordPress plugin Ni WooCommerce Custom Order Status (versions before 1.9.7). The get_query() function does not properly sanitize the sort parameter before using it in a SQL statement via the niwoocos_ajax action, enabling SQL injection. Impact described across...

PT-2021-16327

Name of the Vulnerable Software and Affected Versions: Ni WooCommerce Custom Order Status WordPress plugin versions prior to 1.9.7 Description: The issue concerns the get query function, which does not properly sanitise the sort parameter before using it in a SQL statement. This leads to an SQL...

CVE-2021-24846: Improper Neutralization of Special Elements used in an SQL Command

The getquery function of the Ni WooCommerce Custom Order Status WordPress plugin before 1.9.7, used by the niwoocosajax AJAX action, available to all authenticated users, does not properly sanitise the sort parameter before using it in a SQL statement, leading to an SQL injection, exploitable by...

WordPress Ni WooCommerce Custom Order Status plugin <= 1.9.6 - SQL Injection (SQLi) vulnerability

SQL Injection SQLi vulnerability discovered by JrXnm in WordPress Ni WooCommerce Custom Order Status plugin versions = 1.9.6. Solution Update the WordPress Ni WooCommerce Custom Order Status plugin to the latest available version at least 1.9.7...