WordPress Points and Rewards for WooCommerce Plugin <= 1.5.0 is vulnerable to Settings Change

Software Points and Rewards for WooCommerce Type Plugin Vulnerable versions = 1.5.0 Fixed in 1.6.0 OWASP Top 10 A2: Broken Authentication Classification Settings Change CVE CVE-2023-27607 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 30461bd57ddb Credits Dave Jong...

CVE-2022-47449

Unauth. Reflected Cross-Site Scripting XSS vulnerability in RexTheme Cart Lift – Abandoned Cart Recovery for WooCommerce and EDD plugin = 3.1.5 versions...

CVE-2023-29170

Auth. admin+ Stored Cross-site Scripting XSS vulnerability in PI Websolution Product Enquiry for WooCommerce, WooCommerce product catalog plugin = 2.2.12 versions...

Cross site scripting

Auth. admin+ Stored Cross-site Scripting XSS vulnerability in PI Websolution Product page shipping calculator for WooCommerce plugin = 1.3.20 versions...

CVE-2023-29094

CVE-2023-29094 affects the WordPress plugin Product page shipping calculator for WooCommerce (PI Websolution), vulnerable in versions

CVE-2023-29094 WordPress Product page shipping calculator for WooCommerce Plugin <= 1.3.20 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-site Scripting XSS vulnerability in PI Websolution Product page shipping calculator for WooCommerce plugin = 1.3.20 versions...

PT-2023-22184 · Unknown · Woocommerce +1

Name of the Vulnerable Software and Affected Versions: PI Websolution Product Enquiry for WooCommerce versions 2.2.12 and earlier Description: The issue is related to a Stored Cross-site Scripting XSS vulnerability that requires authentication with admin+ privileges. This vulnerability affects th...

CVE-2022-46793

Cross-Site Request Forgery CSRF vulnerability in AdTribes.Io Product Feed PRO for WooCommerce plugin = 12.4.4 versions...

WordPress Product Enquiry for WooCommerce Plugin <= 2.2.12 is vulnerable to Cross Site Scripting (XSS)

Software Product Enquiry for WooCommerce Type Plugin Vulnerable versions = 2.2.12 Fixed in 2.2.13 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-29170 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID b43cae5ebb34 Credits Myung...

JustTables – WooCommerce Product Table < 1.5.0 - Cross-Site Request Forgery

The plugin does not adequately protect against CSRF attacks, leading to potential unauthorized actions...

WordPress Direct checkout, Add to cart redirect for Woocommerce Plugin <= 2.1.48 is vulnerable to Cross Site Scripting (XSS)

Software Direct checkout, Add to cart redirect for Woocommerce Type Plugin Vulnerable versions = 2.1.48 Fixed in 2.1.49 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-28988 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID...

WordPress Product Specifications for Woocommerce Plugin <= 0.6.0 is vulnerable to Cross Site Scripting (XSS)

Software Product Specifications for Woocommerce Type Plugin Vulnerable versions = 0.6.0 Fixed in 0.7.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-46858 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID b67f88c69a6d...

Elementor Pro < 3.11.7 - Subscriber+ Arbitrary Options Update

The plugin does not have authorisation in an AJAX action relying only on a nonce, which is available to any authenticated users, and does not validate the options to be updated. This allows any authenticated users, such as subscriber to update arbitrary blog options, such as the defaultrole, when...

CVE-2022-47589

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in this.Functional CTT Expresso para WooCommerce plugin = 3.2.11 versions...

CVE-2023-28422

Auth. admin+ Stored Cross-site Scripting XSS vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce = 3.8.6. versions...

CVE-2023-28422 WordPress Event Manager for WooCommerce Plugin <= 3.8.6 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-site Scripting XSS vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce = 3.8.6. versions...

CVE-2023-28422 WordPress Event Manager for WooCommerce Plugin <= 3.8.6 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-site Scripting XSS vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce = 3.8.6. versions...

PT-2023-21709 · Magepeople · Magepeople Team Event Manager/Tickets Selling Plugin For Woocommerce

Name of the Vulnerable Software and Affected Versions: MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce versions 3.8.6 and earlier Description: The issue is related to a Stored Cross-site Scripting XSS vulnerability that requires authentication with admin+ privileges. This...

CVE-2023-28665

The Woo Bulk Price Update WordPress plugin, in versions 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'page' parameter to the technogetproducts action, which can only be triggered by an authenticated user...

WordPress Event Manager for WooCommerce Plugin <= 3.7.7 is vulnerable to Cross Site Request Forgery (CSRF)

Software Event Manager for WooCommerce Type Plugin Vulnerable versions = 3.7.7 Fixed in 3.7.8 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-47164 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID eb513352b8db Credits Istvá...