PT-2023-21579 · WordPress · Woocommerce Payments

Name of the Vulnerable Software and Affected Versions: WooCommerce Payments plugin for WordPress versions 5.6.1 and lower Description: An issue in the WooCommerce Payments plugin for WordPress allows an unauthenticated attacker to send requests on behalf of an elevated user, such as an...

CVE-2023-28121

An issue in WooCommerce Payments plugin for WordPress versions 5.6.1 and lower allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. This allows a remote, unauthenticated attacker to gain admin access on a site that has the affected version of the...

CVE-2023-28121

CVE-2023-28121 – WooCommerce Payments (WordPress) An authentication bypass vulnerability affects the WooCommerce Payments plugin for WordPress, in versions 5.6.1 and lower. An unauthenticated attacker can induce requests or actions that run with an elevated user (e.g., administrator) privileges, ...

CVE-2023-25702

Auth. admin+ Stored Cross-site Scripting XSS vulnerability in Fullworks Quick Paypal Payments plugin = 5.7.25 versions...

CVE-2023-25713

Unauth. Stored Cross-Site Scripting XSS vulnerability in Fullworks Quick Paypal Payments plugin = 5.7.25 versions...

CVE-2023-25713

Unauth. Stored Cross-Site Scripting XSS vulnerability in Fullworks Quick Paypal Payments plugin = 5.7.25 versions...

CVE-2023-25702

Auth. admin+ Stored Cross-site Scripting XSS vulnerability in Fullworks Quick Paypal Payments plugin = 5.7.25 versions...

Cross site scripting

Unauth. Stored Cross-Site Scripting XSS vulnerability in Fullworks Quick Paypal Payments plugin = 5.7.25 versions...

CVE-2023-25713

CVE-2023-25713 affects the WordPress plugin Quick Paypal Payments (Fullworks) up to version 5.7.25, with an unauthenticated Stored XSS vulnerability arising from insufficient input sanitization/escaping. Impact described in connected sources includes cross-site scripting exposure to unauthenticat...

CVE-2023-25702 WordPress Quick Paypal Payments Plugin <= 5.7.25 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-site Scripting XSS vulnerability in Fullworks Quick Paypal Payments plugin = 5.7.25 versions...

CVE-2023-25702

CVE-2023-25702 affects the WordPress Quick Paypal Payments (Fullworks) plugin ≤ 5.7.25. The root cause is insufficient sanitization/escaping in settings, enabling Admin+ Stored XSS. Impact per sources is stored XSS with low overall risk, requiring high privileges and user interaction in some vect...

WordPress Plugin Quick Paypal Payments 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

WordPress Plugin Quick Paypal Payments 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

CVE-2022-4937

The WCFM Frontend Manager plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 6.6.0 due to missing capability checks on various AJAX actions. This makes it possible for authenticated attackers, with minimal permissions such as...

WCFM Frontend Manager < 6.6.1 - Subscriber+ Unauthorised AJAX Calls

The plugin does not have authorisation in various AJAX actions, allowing any authenticated users, such as subscriber to call them and modify knowledge bases/notices/payments, manage vendors etc...

Quick Paypal Payments < 5.7.26.4 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup Original request - with sandbox=checked POST...

Quick Paypal Payments < 5.7.26.4 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC Original request - with sandbox=checked POST...

Exploit for Improper Authentication in Automattic Woocommerce_Payments

CVE-2023-28121 WooCommerce Payments: Unauthorized Admin Access...

Financial cyberthreats in 2022

Financial gain remains the key driver of cybercriminal activity. In the past year, weve seen multiple developments in this area – from new attack schemes targeting contactless payments to multiple ransomware groups continuing to emerge and haunt businesses. However, traditional financial threats ...

Malicious code in firestore-stripe-payments (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fe8379e4865e08389112e877335adb792c71474239b3b6b500505ea736cde7f3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...