WordPress Plugin WooCommerce Admin (woocommerce-admin) Full Path Disclosure Detection

WordPress Plugin WooCommerce Admin plugin files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin WooCommerce Admin plugin files are public...

CVE-2024-1639

The License Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the showLicenseKey and showAllLicenseKeys functions in all versions up to, and including, 3.0.7. This makes it possible for authenticated attackers, with admi...

MultiParcels Shipping For WooCommerce < 1.15.4 - Reflected XSS

Description The plugin does not sanitise and escape various parameters before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Note: The issue was fixed in 1.14.15 but re-introduced in 1.14.16 PoC Make a...

WooCommerce < 5.7.0 & WooCommerce Admin < 2.6.4 - Analytics Report Leaks

The plugin was vulnerable to Analytics Report Leaks on some hosting configurations. As well as updating WooCommerce to at least version 5.7.0, and WooCommerce Admin to at least version 2.6.4, it is also recommended that directory listing is disabled on your host. Automattic updates were rolled ou...