CVE-2023-28422

Auth. admin+ Stored Cross-site Scripting XSS vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce = 3.8.6. versions...

CVE-2023-0503

The Free WooCommerce Theme 99fy Extension WordPress plugin before 1.2.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack...

CVE-2023-0479

The Print Invoice & Delivery Notes for WooCommerce WordPress plugin before 4.7.2 is vulnerable to reflected XSS by echoing a GET value in an admin note within the WooCommerce orders page. This means that this vulnerability can be exploited for users with the editothersshoporders capability...

CVE-2023-0942

The Japanized For WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in versions up to, and including, 2.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...

CVE-2023-0865

The WooCommerce Multiple Customer Addresses & Shipping WordPress plugin before 21.7 does not ensure that the address to add/update/retrieve/delete and duplicate belong to the user making the request, or is from a high privilege users, allowing any authenticated users, such as subscriber to...

CVE-2023-52215

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in UkrSolution Simple Inventory Management – just scan barcode to manage products and orders. For WooCommerce.This issue affects Simple Inventory Management – just scan barcode to manage products and...

CVE-2023-30492

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Vark Minimum Purchase for WooCommerce plugin = 2.0.0.1 versions...

CVE-2023-30747

Unauth. Reflected Cross-Site Scripting XSS vulnerability in WPGem WooCommerce Easy Duplicate Product plugin = 0.3.0.0 versions...

CVE-2023-47696

Unauth. Stored Cross-Site Scripting XSS vulnerability in Gravity Master Product Enquiry for WooCommerce plugin = 3.0 versions...

CVE-2023-47658

Auth. ShopManager+ Stored Cross-Site Scripting XSS vulnerability in actpro Extra Product Options for WooCommerce plugin = 3.0.3 versions...

CVE-2023-47660

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WP Wham Product Visibility by Country for WooCommerce plugin = 1.4.9 versions...

CVE-2023-29094

Auth. admin+ Stored Cross-site Scripting XSS vulnerability in PI Websolution Product page shipping calculator for WooCommerce plugin = 1.3.20 versions...

CVE-2023-29423

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in PI Websolution Cancel order request / Return order / Repeat Order / Reorder for WooCommerce plugin = 1.3.2 versions...

CVE-2023-41874

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Tyche Softwares Order Delivery Date for WooCommerce plugin = 3.20.0 versions...

CVE-2023-32575

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in PI Websolution Product page shipping calculator for WooCommerce plugin = 1.3.25 versions...

CVE-2023-32118

Unauth. Reflected Cross-Site Scripting XSS vulnerability in WPoperation SALERT – Fake Sales Notification WooCommerce plugin = 1.2.1 versions...

CVE-2023-32745

Cross-Site Request Forgery CSRF vulnerability in WooCommerce AutomateWoo plugin = 5.7.1 versions...

CVE-2023-5957

The Ni Purchase OrderPO For WooCommerce WordPress plugin through 1.2.1 does not validate logo and signature image files uploaded in the settings, allowing high privileged user to upload arbitrary files to the web server, triggering an RCE vulnerability by uploading a web shell...

CVE-2023-36383

Auth. editor+ Stored Cross-Site Scripting XSS vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce plugin = 3.9.5 versions...

CVE-2023-6625

The Product Enquiry for WooCommerce WordPress plugin before 3.1 does not have a CSRF check in place when deleting inquiries, which could allow attackers to make a logged in admin delete them via a CSRF attack...