23 matches found
CVE-2026-114173
The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat actor could read product passwords and private product metadata from an affected store...
CVE-2026-113409
The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripting. A threat actor able to modify the plugin's configuration could execute arbitrary JavaScript in an administrator's session when they visited the impacted...
CVE-2026-113387
The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin's configuration to serve arbitrary scripts...
CVE-2026-113409
The Ortto plugin for WordPress (versions before 1.0.25 ) is vulnerable to stored cross-site scripting (XSS) . The root cause is a failure to properly escape stored settings on the plugin's admin settings page . An attacker capable of modifying the plugin's configuration can execute arbitrary Java...
CVE-2026-113409
The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripting. A threat actor able to modify the plugin's configuration could execute arbitrary JavaScript in an administrator's session when they visited the impacted...
EUVD-2026-112571
The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripting. A threat actor able to modify the plugin's configuration could execute arbitrary JavaScript in an administrator's session when they visited the impacted...
CVE-2026-114173
The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat actor could read product passwords and private product metadata from an affected store...
CVE-2026-114173
The Ortto plugin for WordPress (versions before 1.0.25 ) is vulnerable to information disclosure because it fails to filter WooCommerce product data embedded in public storefront pages. This allows an unauthenticated threat actor to read product passwords and private product metadata from an affe...
EUVD-2026-112570
The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat actor could read product passwords and private product metadata from an affected store...
CVE-2026-113387
The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin's configuration to serve arbitrary scripts...
CVE-2026-113387
The Ortto plugin for WordPress (versions prior to 1.0.25 ) is vulnerable to an authentication bypass. The plugin fails to properly authenticate configuration update requests, relying instead on a secret that is exposed in public HTML. An unauthenticated threat actor can exploit this flaw to overw...
EUVD-2026-112569
The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin's configuration to serve arbitrary scripts...
EUVD-2024-46077
Malicious code in bioql PyPI...
CVE-2024-52482
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in rafalautopilot Ortto autopilot allows Reflected XSS.This issue affects Ortto: from n/a through = 1.0.19...
CVE-2024-52482
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in rafalautopilot Ortto autopilot allows Reflected XSS.This issue affects Ortto: from n/a through = 1.0.19...
CVE-2024-52482 WordPress Ortto plugin <= 1.0.19 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in rafalautopilot Ortto autopilot allows Reflected XSS.This issue affects Ortto: from n/a through = 1.0.19...
CVE-2024-52482 WordPress Ortto plugin <= 1.0.19 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in rafalautopilot Ortto autopilot allows Reflected XSS.This issue affects Ortto: from n/a through = 1.0.19...
CVE-2024-52482
CVE-2024-52482 is a reflected Cross-Site Scripting (XSS) vulnerability in the WordPress Ortto plugin, affecting Ortto versions up to and including 1.0.19. The CVSS v3.1 base score is 7.1 ( HIGH ). Remediation per the connected Patchstack/PT documents: update Ortto to a version later than 1.0.19 o...
PT-2024-35323 · Ortto · Ortto
Name of the Vulnerable Software and Affected Versions: Ortto versions 1.0.19 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows Reflected XSS. This means an attacker can inject malicious scripts into the website, potentially...
WordPress plugin Ortto has a cross-site scripting vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...