WordPress Plugin Payment gateway per Product for WooCommerce Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2023-29128 · Woocommerce · Dreamfox Media Payment Gateway Per Product For Woocommerce

Name of the Vulnerable Software and Affected Versions: Dreamfox Payment gateway per Product for WooCommerce plugin versions 3.2.7 and earlier Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This type of vulnerability allows an attacker to inject...

WooCommerce CVR Payment Gateway < 6.1.0 - Missing Authorization to Authenticated (Contributor+) CVR Update

Description The WooCommerce CVR Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the refreshordercvrdata AJAX action. This makes it possible for authenticated attackers with contributor-level access and above, to update C...

CVE-2023-4948

The WooCommerce CVR Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the refreshordercvrdata AJAX action in versions up to 6.1.0. This makes it possible for authenticated attackers with contributor-level access and above,...

Design/Logic Flaw

The WooCommerce CVR Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the refreshordercvrdata AJAX action in versions up to 6.1.0. This makes it possible for authenticated attackers with contributor-level access and above,...

CVE-2023-4948

CVE-2023-4948 affects the WooCommerce CVR Payment Gateway plugin for WordPress up to version 6.1.0 . The issue is a missing capability check on the refresh_order_cvr_data AJAX action, allowing authenticated attackers with contributor-level access and above to update CVR numbers for orders. The vu...

CVE-2023-4948

The WooCommerce CVR Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the refreshordercvrdata AJAX action in versions up to 6.1.0. This makes it possible for authenticated attackers with contributor-level access and above,...

WordPress WooCommerce CVR Payment Gateway Plugin < 6.1.0 is vulnerable to Broken Access Control

Software WooCommerce CVR Payment Gateway Type Plugin Vulnerable versions 6.1.0 Fixed in 6.1.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-4948 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID d4365149d5e3 Credits Lana Codes Yan&C...

WordPress Plugin WooCommerce CVR Payment Gateway Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in...

WordPress WooCommerce EAN Payment Gateway Plugin < 6.1.0 is vulnerable to Broken Access Control

Software WooCommerce EAN Payment Gateway Type Plugin Vulnerable versions 6.1.0 Fixed in 6.1.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-4947 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 9bfa8f9c4e66 Credits Lana Codes Yan&C...

WakaTime: Waketime Payment Gateway Vulnerability

Vulnerability description not provided...

WordPress Stripe Payment Gateway for WooCommerce Plugin <= 3.7.7 is vulnerable to Privilege Escalation

Software Stripe Payment Gateway for WooCommerce Type Plugin Vulnerable versions = 3.7.7 Fixed in 3.7.8 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2023-3162 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID...

WordPress Choice Payment Gateway for WooCommerce Plugin <= 2.1.2 is vulnerable to Cross Site Scripting (XSS)

Software Choice Payment Gateway for WooCommerce Type Plugin Vulnerable versions = 2.1.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID fa9893c69c54 Credits Rafie...

WordPress Authorize.Net Payment Gateway For WooCommerce Plugin < 6.0.4 is vulnerable to Cross Site Scripting (XSS)

Software Authorize.Net Payment Gateway For WooCommerce Type Plugin Vulnerable versions 6.0.4 Fixed in 6.0.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID d6e190843d57 Credits Rafi...

WordPress Payment Gateway Groups for WooCommerce Plugin <= 1.1.3 is vulnerable to Cross Site Scripting (XSS)

Software Payment Gateway Groups for WooCommerce Type Plugin Vulnerable versions = 1.1.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID b23d24f13593 Credits Rafie...

WordPress RecurWP – WordPress Recurly Payment Gateway Plugin <= 1.0.3 is vulnerable to Cross Site Scripting (XSS)

Software RecurWP – WordPress Recurly Payment Gateway Type Plugin Vulnerable versions = 1.0.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 4a644c62a9fc Credits Rafie...

WordPress Ether and ERC20 tokens WooCommerce Payment Gateway Plugin < 4.12.13 is vulnerable to Cross Site Scripting (XSS)

Software Ether and ERC20 tokens WooCommerce Payment Gateway Type Plugin Vulnerable versions 4.12.13 Fixed in 4.12.13 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 9ea50f0867f0...

WordPress Dreamfox Media Payment gateway per Product for Woocommerce Plugin < 3.2.7 is vulnerable to Cross Site Scripting (XSS)

Software Dreamfox Media Payment gateway per Product for Woocommerce Type Plugin Vulnerable versions 3.2.7 Fixed in 3.2.7 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID f228b3d2c1e8...

WordPress Payment Gateway for PayFabric Plugin <= 1.0.12.2 is vulnerable to Cross Site Scripting (XSS)

Software Payment Gateway for PayFabric Type Plugin Vulnerable versions = 1.0.12.2 Fixed in 1.0.13 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 40f2aa177659 Credits Rafie Muhammad...

WooCommerce Stripe Payment Gateway Plugin for WordPress < 7.4.1 Insecure Direct Object Reference

The WordPress WooCommerce Stripe Payment Gateway Plugin installed on the remote host is affected by an Insecure Direct Object Reference leading to Personally Identifiable Information Disclosure. Note that the scanner has not tested for these issues but has instead relied only on the application's...