PT-2023-13760 · WordPress · Booster Plus For Woocommerce +2

Name of the Vulnerable Software and Affected Versions: Booster for WooCommerce WordPress plugin versions prior to 6.0.1 Booster Plus for WooCommerce WordPress plugin versions prior to 6.0.1 Booster Elite for WooCommerce WordPress plugin versions prior to 6.0.1 Description: The issue is related to...

WordPress EAN for WooCommerce Plugin < 4.4.3 is vulnerable to Cross Site Scripting (XSS)

Software EAN for WooCommerce Type Plugin Vulnerable versions 4.4.3 Fixed in 4.4.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0062 Patch priority Medium CVSS severity Medium 6.3 Developer Claim ownership PSID efcc1edc10be Credits Lana Codes...

PT-2023-13715 · WordPress · Activecampaign For Woocommerce

Name of the Vulnerable Software and Affected Versions: ActiveCampaign for WooCommerce WordPress plugin versions prior to 1.9.8 Description: The issue concerns a lack of authorization check when cleaning up error logs via an AJAX action. This could allow any authenticated users, such as subscriber...

WordPress plugin Booster for WooCommerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin Booster fo...

CVE-2022-4016 Booster for WooCommerce - Custom Role Creation/Deletion via CSRF

The Booster for WooCommerce WordPress plugin before 5.6.7, Booster Plus for WooCommerce WordPress plugin before 5.6.6, Booster Elite for WooCommerce WordPress plugin before 1.1.8 does not properly check for CSRF when creating and deleting Customer roles, allowing attackers to make logged admins...

PT-2022-25254 · WordPress · Booster Elite For Woocommerce +2

Name of the Vulnerable Software and Affected Versions: Booster for WooCommerce WordPress plugin versions prior to 5.6.7 Booster Plus for WooCommerce WordPress plugin versions prior to 5.6.6 Booster Elite for WooCommerce WordPress plugin versions prior to 1.1.8 Description: The issue concerns a...

CVE-2022-3763

The Booster for WooCommerce WordPress plugin before 5.6.7, Booster Plus for WooCommerce WordPress plugin before 5.6.5, Booster Elite for WooCommerce WordPress plugin before 1.1.7 do not have CSRF check in place when deleting files uploaded at the checkout, allowing attackers to make a logged in...

CVE-2022-3763 Booster for WooCommerce - Checkout Files Deletion via CSRF

The Booster for WooCommerce WordPress plugin before 5.6.7, Booster Plus for WooCommerce WordPress plugin before 5.6.5, Booster Elite for WooCommerce WordPress plugin before 1.1.7 do not have CSRF check in place when deleting files uploaded at the checkout, allowing attackers to make a logged in...

WordPress plugin Booster for WooCommerce 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

CVE-2022-41805

Cross-Site Request Forgery CSRF vulnerability in Booster for WooCommerce plugin = 5.6.6 on WordPress...

CVE-2022-41805

Cross-Site Request Forgery CSRF vulnerability in Booster for WooCommerce plugin = 5.6.6 on WordPress...

CVE-2022-41805

CVE-2022-41805 affects Booster for WooCommerce plugin versions 5.6.6, specifically at least 5.6.7, as recommended by multiple sources. If updating is not possible, monitor for official mitigations in patches. It is not stated whether this CVE has known in-the-wild exploits within the provided do...

CVE-2022-2556

The Mailchimp for WooCommerce WordPress plugin before 2.7.2 has an AJAX action that allows high privilege users to perform a POST request on behalf of the server to the internal network/LAN, the body of the request is also appended to the response so it can be used to scan private network for...

CVE-2022-2556

The Mailchimp for WooCommerce WordPress plugin before 2.7.2 has an AJAX action that allows high privilege users to perform a POST request on behalf of the server to the internal network/LAN, the body of the request is also appended to the response so it can be used to scan private network for...

CVE-2022-36379 WordPress ЮKassa для WooCommerce plugin <= 2.3.0 - Cross-Site Request Forgery (CSRF) leading to plugin settings update

Cross-Site Request Forgery CSRF leading to plugin settings update in YooMoney ЮKassa для WooCommerce plugin = 2.3.0 at WordPress...

WordPress plugin Affiliate For WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

MAL-2022-4670 Malicious code in mollie-payments-for-woocommerce (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8ace8fe2059c96e7ca279ea00db7464050a8dde295ee4165f15edb0fce4ffaad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress 安全漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blogging sites on servers with PHP and MySQL. cross-site scripting vulnerability exists in versions of WordPress PPOM for WooCommerce plugin...

CVE-2021-24999

The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcjnotice parameter before outputting it back in the admin dashboard when the Pdf Invoicing module is enabled, leading to a Reflected Cross-Site Scripting...

CVE-2021-25001

The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcjcreateproductsxmlresult parameter before outputting back in the admin dashboard when the Product XML Feeds module is enabled, leading to a Reflected Cross-Site Scripting issue...