CVE-2021-24846

The getquery function of the Ni WooCommerce Custom Order Status WordPress plugin before 1.9.7, used by the niwoocosajax AJAX action, available to all authenticated users, does not properly sanitise the sort parameter before using it in a SQL statement, leading to an SQL injection, exploitable by...

WordPress Additional Custom Order Status for WooCommerce plugin <= 1.6.0 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin Additional Custom Order Status for WooCommerce versions = 1.6.0...

WordPress Custom Order Status Per Product for WooCommerce plugin <= 1.6.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Custom Order Status Per Product for WooCommerce plugin versions = 1.6.1. Solution No patched version available...

WordPress Custom Order Status Per Product for WooCommerce plugin <= 1.6.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Custom Order Status Per Product for WooCommerce plugin versions = 1.6.1. Solution No patched version available...

WordPress Ni WooCommerce Custom Order Status plugin SQL injection vulnerability

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.A SQL injection vulnerability exists in the WordPress Ni WooCommerce Custom Order Status plugin, which stems fro...

CVE-2021-24846

The CVE-2021-24846 issue affects the WordPress plugin Ni WooCommerce Custom Order Status (versions before 1.9.7). The get_query() function does not properly sanitize the sort parameter before using it in a SQL statement via the niwoocos_ajax action, enabling SQL injection. Impact described across...

WordPress Ni WooCommerce Custom Order Status plugin <= 1.9.6 - SQL Injection (SQLi) vulnerability

SQL Injection SQLi vulnerability discovered by JrXnm in WordPress Ni WooCommerce Custom Order Status plugin versions = 1.9.6. Solution Update the WordPress Ni WooCommerce Custom Order Status plugin to the latest available version at least 1.9.7...