PT-2024-35851 · Woocommerce · Multilevel Referral Affiliate Plugin For Woocommerce

Name of the Vulnerable Software and Affected Versions: Multilevel Referral Affiliate Plugin for WooCommerce versions n/a through 2.27 Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting', which allows reflected XSS...

WordPress Multilevel Referral Affiliate plugin for WooCommerce plugin <= 2.27 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Multilevel Referral Affiliate Plugin for WooCommerce versions = 2.27...

WordPress plugin Wallet for WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exist...

CVE-2024-9170

The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wcjproductmeta shortcode in all versions up to, and including, 7.2.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-9170 Booster for WooCommerce <= 7.2.3 - Authenticated (ShopManager+) Stored Cross-Site Scripting via wcj_product_meta Shortcode

The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wcjproductmeta shortcode in all versions up to, and including, 7.2.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-9170

CVE-2024-9170 (Booster for WooCommerce) is a stored cross-site scripting vulnerability in the Booster for WooCommerce WordPress plugin, affecting all versions up to and including 7.2.3. The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the wc...

CVE-2024-10857

The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.9 via the handledownloads function due to insufficient file path validation/sanitization. This makes it possible for authenticated attackers, with...

CVE-2024-11418

CVE-2024-11418 is a Reflected Cross-Site Scripting vulnerability in the WordPress plugin Additional Order Filters for WooCommerce . The issue arises from insufficient input sanitization and output escaping of the shipping_method_filter parameter, affecting versions up to 1.21. Attackers can compe...

CVE-2024-10729 Booking & Appointment Plugin for WooCommerce <= 6.9.0 - Authenticated (Subscriber+) Arbitrary Option Update

The Booking & Appointment Plugin for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'savegooglecalendardata' function in versions up to, and including, 6.9.0. This makes it possible for authenticated attackers, with...

PT-2024-16596 · WordPress · Product Input Fields For Woocommerce

Name of the Vulnerable Software and Affected Versions: Product Input Fields for WooCommerce plugin for WordPress versions up to, and including, 1.9 Description: The issue allows authenticated attackers with Contributor-level access and above to read the contents of arbitrary files on the server,...

PT-2024-16491 · Woocommerce · Booking & Appointment Plugin For Woocommerce

Name of the Vulnerable Software and Affected Versions: Booking & Appointment Plugin for WooCommerce version 6.9.0 and earlier Description: The issue is related to a missing capability check in the save google calendar data function, allowing authenticated attackers with subscriber-level permissio...

WordPress plugin Booking & Appointment Plugin for WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress Booking & Appointment Plugin for WooCommerce plugin <= 6.9.0 - Authenticated (Subscriber+) Arbitrary Option Update vulnerability

Authenticated Subscriber+ Arbitrary Option Update vulnerability discovered by István Márton in WordPress Plugin Booking & Appointment Plugin for WooCommerce versions = 6.9.0...

VulnCheck KEV: CVE-2024-10857

The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.9 via the handledownloads function due to insufficient file path validation/sanitization. This makes it possible for authenticated attackers, with...

WordPress Product Input Fields for WooCommerce Plugin <= 1.9 is vulnerable to Path Traversal

Software Product Input Fields for WooCommerce Type Plugin Vulnerable versions = 1.9 Fixed in 2.0 OWASP Top 10 A3: Injection Classification Path Traversal CVE CVE-2024-10857 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 1aed7531d6f7 Credits 1337Wannabe Required...

CVE-2024-11361

The PDF Invoices & Packing Slips Generator for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 2.2.1. This makes it possible for unauthenticated attackers t...

PT-2024-39732 · WordPress · Checkout With Cash App On Woocommerce

Name of the Vulnerable Software and Affected Versions: Checkout with Cash App on WooCommerce plugin for WordPress versions up to, and including, 6.0.2 Description: The issue is related to Reflected Cross-Site Scripting via the wp http referer parameter in several files due to insufficient input...

WordPress Checkout with Cash App on WooCommerce plugin <= 6.0.2 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin Checkout with Cash App on WooCommerce versions = 6.0.2...

WordPress Product Table for WooCommerce Plugin <= 3.5.1 is vulnerable to Sensitive Data Exposure

Software Product Table for WooCommerce Type Plugin Vulnerable versions = 3.5.1 Fixed in 3.5.2 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-10813 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 157ba908784e Credits Nathan...

CVE-2024-11370

The Subaccounts for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.6.0. This makes it possible for unauthenticated attackers to inject arbitrary web...