PT-2024-20569 · Unknown · Adtribes.Io Product Feed Pro For Woocommerce

Name of the Vulnerable Software and Affected Versions: AdTribes.Io Product Feed PRO for WooCommerce versions through 13.2.5 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. Recommendations...

WordPress Product Feed PRO for WooCommerce Plugin <= 13.2.5 is vulnerable to Cross Site Scripting (XSS)

Software Product Feed PRO for WooCommerce Type Plugin Vulnerable versions = 13.2.5 Fixed in 13.2.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-24800 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 937a0dd44e83 Credits Rafie Muhamma...

CVE-2023-27608

Missing Authorization vulnerability in WP Swings Points and Rewards for WooCommerce.This issue affects Points and Rewards for WooCommerce: from n/a through 1.5.0...

WordPress Plugin Points and Rewards for WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

CVE-2024-2025 BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages <= 3.4.20 - Authenticated (Subscriber+) PHP Object Injection in get_simple_request

The "BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages" plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.20 via deserialization of untrusted input in the getsimplerequest function. This makes it possible for...

CVE-2024-0957

The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Customer Notes field in all versions up to, and including, 4.4.1 due to insufficient input sanitization and output escaping. This makes it...

CVE-2024-1119 Order Tip for WooCommerce <= 1.3.1 - Missing Authorization to Unauthenticated Data Export

The Order Tip for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exporttipstocsv function in all versions up to, and including, 1.3.1. This makes it possible for unauthenticated attackers to export the plugin's order fees...

WordPress Order Tip for WooCommerce Plugin <= 1.3.1 is vulnerable to Broken Access Control

Software Order Tip for WooCommerce Type Plugin Vulnerable versions = 1.3.1 Fixed in 1.4.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1119 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 6f66f4219506 Credits Francesco Carlucci...

PT-2024-22737 · Iconics · Woothumbs For Woocommerce

Name of the Vulnerable Software and Affected Versions: WooThumbs for WooCommerce by Iconic versions through 5.5.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an...

CVE-2024-1796

The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'woof' shortcode in all versions up to, and including, 1.3.5.1 due to insufficient input sanitization and output escaping on user supplied attributes such as...

PT-2024-18313 · WordPress · Husky – Products Filter For Woocommerce Professional

Name of the Vulnerable Software and Affected Versions: HUSKY – Products Filter for WooCommerce Professional plugin for WordPress versions up to, and including, 1.3.5.2 Description: The issue allows authenticated attackers with contributor-level access and above to perform SQL Injection via the na...

WordPress Plugin HUSKY - Products Filter for WooCommerce Professional Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

PT-2024-13978 · Woocommerce · Husky – Products Filter For Woocommerce

Name of the Vulnerable Software and Affected Versions: HUSKY – Products Filter for WooCommerce formerly WOOF versions 1.3.4.3 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the HUSKY – Products Filter for WooCommerce formerly WOOF plugin. This type of issue allows an...

CVE-2024-0683

The Bulgarisation for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several functions in all versions up to, and including, 3.0.14. This makes it possible for unauthenticated and authenticated attackers, with subscriber-level access and...

Cross site request forgery (csrf)

The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.9. This is due to missing or incorrect nonce validation on the processBulkAction function. This makes it possible for unauthenticated attacker...

CVE-2024-1489 SMS Alert Order Notifications – WooCommerce <= 3.6.9 - Cross-Site Request Forgery

The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.9. This is due to missing or incorrect nonce validation on the processBulkAction function. This makes it possible for unauthenticated attacker...

CVE-2024-1489

The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.9. This is due to missing or incorrect nonce validation on the processBulkAction function. This makes it possible for unauthenticated attacker...

PT-2024-20196 · WordPress · Bulgarisation For Woocommerce

Name of the Vulnerable Software and Affected Versions: Bulgarisation for WooCommerce plugin for WordPress versions up to, and including, 3.0.14 Description: The issue is due to missing or incorrect nonce validation on several functions, making it possible for unauthenticated attackers to generate...

CVE-2024-1773

The PDF Invoices and Packing Slips For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.7 via deserialization of untrusted input via the orderid parameter. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2024-1534

The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 7.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...