PT-2024-37655 · WordPress · Sip Reviews Shortcode

Name of the Vulnerable Software and Affected Versions: SIP Reviews Shortcode for WooCommerce plugin for WordPress versions up to, and including, 1.2.3 Description: The issue is related to SQL Injection via the no of reviews attribute in the "woocommerce reviews" shortcode. This occurs due to...

WordPress plugin SIP Reviews Shortcode for WooCommerce SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...

WordPress plugin SIP Reviews Shortcode for WooCommerce SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection...

WordPress Get Quote For Woocommerce – Request A Quote For Woocommerce plugin <= 1.0.0 - Missing Authorization to Unauthenticated Quote PDF and CSV Download vulnerability

Missing Authorization to Unauthenticated Quote PDF and CSV Download vulnerability discovered by stehled in WordPress Plugin Get Quote For Woocommerce versions = 1.0.0...

CVE-2024-10233

CVE-2024-10233 affects the SMS Alert Order Notifications – WooCommerce WordPress plugin. It is vulnerable in all versions up to and including 3.7.5 due to insufficient input sanitization and output escaping on the sa_subscribe shortcode attributes, enabling an authenticated attacker with contribu...

CVE-2024-10233 SMSAlert - WooCommerce <= 3.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_subscribe Shortcode

The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sasubscribe shortcode in all versions up to, and including, 3.7.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes i...

CVE-2024-10437 WPC Smart Messages for WooCommerce <= 4.2.1 - Missing Authorization to Authenticated (Subscriber+) Message Activation/Deactivation

The WPC Smart Messages for WooCommerce plugin for WordPress is vulnerable to unauthorized Smar Message activation/deactivation due to a missing capability check on the ajaxenable function in all versions up to, and including, 4.2.1. This makes it possible for authenticated attackers, with...

CVE-2024-10436

CVE-2024-10436 affects the WPC Smart Messages for WooCommerce WordPress plugin, with Local File Inclusion via the get_condition_value function in all versions up to and including 4.2.1. Authenticated attackers with Subscriber-level access or higher can include and execute arbitrary PHP files on t...

PT-2024-16281 · WordPress · Wpc Smart Messages

Name of the Vulnerable Software and Affected Versions: WPC Smart Messages for WooCommerce plugin for WordPress versions up to, and including, 4.2.1 Description: The issue allows authenticated attackers with Subscriber-level access and above to include and execute arbitrary files on the server via...

PT-2024-16282 · WordPress · Wpc Smart Messages

Name of the Vulnerable Software and Affected Versions: WPC Smart Messages for WooCommerce plugin for WordPress versions up to, and including, 4.2.1 Description: The issue allows authenticated attackers with Subscriber-level access and above to activate or deactivate smart messages due to a missin...

WordPress plugin Sudan Payment Gateway for WooCommerce 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in the...

CVE-2024-50447 WordPress Envo's Elementor Templates & Widgets for WooCommerce plugin <= 1.4.19 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in EnvoThemes Envo's Elementor Templates & Widgets for WooCommerce envo-elementor-for-woocommerce allows Stored XSS.This issue affects Envo's Elementor Templates & Widgets for WooCommerce: from n/a...

WordPress AR For Woocommerce plugin <= 6.3 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin AR For Woocommerce versions = 6.3...

CVE-2024-9214 Extra Product Options Builder for WooCommerce <= 1.2.133 - Unauthenticated Stored Cross-Site Scripting

The Extra Product Options Builder for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'RednaoSerializedFields' parameter during the creation of a signature file in all versions up to, and including, 1.2.133 due to insufficient input sanitization and output...

WordPress Envo's Elementor Templates & Widgets for WooCommerce plugin <= 1.4.19 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin Envo's Elementor Templates & Widgets for WooCommerce versions = 1.4.19...

WordPress WPC Shop as a Customer for WooCommerce plugin <= 1.2.6 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin WPC Shop as a Customer for WooCommerce versions = 1.2.6...

WordPress Extra Product Options Builder for WooCommerce plugin <= 1.2.133 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Aitor F kr0no in WordPress Plugin Extra Product Options Builder for WooCommerce versions = 1.2.133...

WordPress plugin Extra Product Options Builder for WooCommerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2024-47634

Cross-Site Request Forgery CSRF vulnerability in Streamline.Lv CartBounty – Save and recover abandoned carts for WooCommerce allows Cross Site Request Forgery.This issue affects CartBounty – Save and recover abandoned carts for WooCommerce: from n/a through 8.2...

WordPress plugin EU/UK VAT Manager for WooCommerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...