CVE-2024-4039: Improper Control of Generation of Code

The The Orders Tracking for WooCommerce plugin for WordPress for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.2.10. This is due to the plugin allowing users to execute an action that does not properly validate a value before running doshortcode...

CVE-2023-4216: Undefined Security Weakness

The Orders Tracking for WooCommerce WordPress plugin before 1.2.6 doesn't validate the fileurl parameter when importing a CSV file, allowing high privilege users with the managewoocommerce capability to access any file on the web server via a Traversal attack. The content retrieved is however...

PT-2022-9618

Name of the Vulnerable Software and Affected Versions Orders Tracking for WooCommerce WordPress plugin versions prior to 1.1.10 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the file url is not properly sanitised and escaped before being outputted...

CVE-2021-25062: Improper Neutralization of Input During Web Page Generation

The Orders Tracking for WooCommerce WordPress plugin before 1.1.10 does not sanitise and escape the fileurl before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting...