WordPress MultiParcels Shipping For WooCommerce Plugin <= 1.15.7 is vulnerable to Cross Site Scripting (XSS)

Software MultiParcels Shipping For WooCommerce Type Plugin Vulnerable versions = 1.15.7 Fixed in 1.15.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE N/A Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID ee8ce231473a Credits N/A Required...

WordPress Shipping method for WooCommerce - Use for Conditional shipping + Extra shipping + flat rate shipping method + Table Rate Shipping for WooCommerce Plugin <= 3.0.9 is vulnerable to Cross Site Scripting (XSS)

Software Shipping method for WooCommerce - Use for Conditional shipping + Extra shipping + flat rate shipping method + Table Rate Shipping for WooCommerce Type Plugin Vulnerable versions = 3.0.9 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Pat...

WordPress Product Shipping Countdown Free Plugin <= 1.0.6 is vulnerable to Cross Site Scripting (XSS)

Software Product Shipping Countdown Free Type Plugin Vulnerable versions = 1.0.6 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 5249592ccbb7 Credits Rafie Muhammad...

WordPress Dreamfox Media Shipping gateway per Product for Woocommerce Plugin < 2.3.3 is vulnerable to Cross Site Scripting (XSS)

Software Dreamfox Media Shipping gateway per Product for Woocommerce Type Plugin Vulnerable versions 2.3.3 Fixed in 2.3.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 34683916968...

WordPress MultiParcels Shipping For WooCommerce Plugin < 1.15.4 is vulnerable to Cross Site Scripting (XSS)

Software MultiParcels Shipping For WooCommerce Type Plugin Vulnerable versions 1.15.4 Fixed in 1.15.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-3671 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 8dd42e4b310c...

WordPress Weight Based Shipping For WooCommerce Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS)

Software Weight Based Shipping For WooCommerce Type Plugin Vulnerable versions = 1.3.2 Fixed in 1.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 73b63a2ddc7e Credits Rafie Muhamm...

WordPress Mojito Shipping Plugin < 1.4.3 is vulnerable to Cross Site Scripting (XSS)

Software Mojito Shipping Type Plugin Vulnerable versions 1.4.3 Fixed in 1.4.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 836e46da79bb Credits Rafie Muhammad Patchstack Required...

WordPress MultiParcels Shipping For WooCommerce Plugin < 1.14.14 is vulnerable to Broken Access Control

Software MultiParcels Shipping For WooCommerce Type Plugin Vulnerable versions 1.14.14 Fixed in 1.14.14 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-3365 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID c3c12e88b9f4 Credits Erwan ...

WordPress Advanced USPS Shipping Method Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS)

Software Advanced USPS Shipping Method Type Plugin Vulnerable versions = 1.0.1 Fixed in 1.0.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID a753901c3acc Credits Rafie Muhammad...

CVE-2023-36514

Cross-Site Request Forgery CSRF vulnerability in WooCommerce Shipping Multiple Addresses plugin = 3.8.5 versions...

CVE-2023-36514

Cross-Site Request Forgery CSRF vulnerability in WooCommerce Shipping Multiple Addresses plugin = 3.8.5 versions...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in WooCommerce Shipping Multiple Addresses plugin = 3.8.5 versions...

CVE-2023-36514 WordPress WooCommerce Ship to Multiple Addresses Plugin <= 3.8.5 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in WooCommerce Shipping Multiple Addresses plugin = 3.8.5 versions...

CVE-2023-36514

CVE-2023-36514 concerns a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin “WooCommerce Ship to Multiple Addresses” (also referred to as Shipping Multiple Addresses) affecting versions earlier than 3.8.6. Public references in the provided documents consistently describe CSR...

MultiParcels Shipping For WooCommerce < 1.14.15 - Subscriber+ SQLi

Description The plugin does not properly sanitize and escape a parameter before using it in an SQL statement, which could allow any authenticated users, such as subscribers, to perform SQL Injection attacks. Note WPScan: The issue was fixed in 1.14.13, however a better patch was done in 1.14.15 a...

MultiParcels Shipping For WooCommerce < 1.14.14 - Subscriber+ Arbitrary Shipment Deletion

Description The plugin does not have authorisation when deleting shipment, allowing any authenticated users, such as subscriber to delete arbitrary shipment Login as a subscriber an open https://example.com/wp-admin/admin-post.php?action=multiparcelsdeleteshipping&id=1 to delete the shipment with...

MultiParcels Shipping For WooCommerce < 1.14.14 - Subscriber+ Arbitrary Shipment Deletion

Description The plugin does not have authorisation when deleting shipment, allowing any authenticated users, such as subscriber to delete arbitrary shipment PoC Login as a subscriber an open https://example.com/wp-admin/admin-post.php?action=multiparcelsdeleteshipping=1 to delete the shipment wit...

MultiParcels Shipping For WooCommerce < 1.15.4 - Reflected XSS

Description The plugin does not sanitise and escape various parameters before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Note: The issue was fixed in 1.14.15 but re-introduced in 1.14.16 PoC Make a...

CVE-2023-34015

Cross-Site Request Forgery CSRF vulnerability in PI Websolution Conditional shipping & Advanced Flat rate shipping rates / Flexible shipping for WooCommerce shipping plugin = 1.6.4.4 versions...

CVE-2023-34015

Cross-Site Request Forgery CSRF vulnerability in PI Websolution Conditional shipping & Advanced Flat rate shipping rates / Flexible shipping for WooCommerce shipping plugin = 1.6.4.4 versions...