3568 matches found
CVE-2023-2256
The Product Addons & Fields for WooCommerce WordPress plugin before 32.0.7 does not sanitize and escape some URL parameters, leading to Reflected Cross-Site Scripting...
CVE-2023-23667
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in BeRocket Brands for WooCommerce plugin = 3.7.0.6 versions...
CVE-2023-5234
The Related Products for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'woo-related' shortcode in versions up to, and including, 3.3.15 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
CVE-2023-49853
Cross-Site Request Forgery CSRF vulnerability in PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş. PayTR Taksit Tablosu – WooCommerce.This issue affects PayTR Taksit Tablosu – WooCommerce: from n/a through 1.3.1...
CVE-2023-51498
Missing Authorization vulnerability in Woo WooCommerce Canada Post Shipping.This issue affects WooCommerce Canada Post Shipping: from n/a through 2.8.3...
CVE-2023-46094
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Conversios Track Google Analytics 4, Facebook Pixel & Conversions API via Google Tag Manager for WooCommerce plugin = 6.5.3 versions...
CVE-2023-6979
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ivoleimportuploadcsv AJAX action in all versions up to, and including, 5.38.9. This makes it possible for authenticated attackers, with author-level access...
CVE-2023-33316
Cross-Site Request Forgery CSRF vulnerability in WooCommerce WooCommerce Follow-Up Emails AutomateWoo plugin = 4.9.40 versions...
CVE-2023-47690
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Anton Bond Additional Order Filters for WooCommerce plugin = 1.10 versions...
CVE-2023-47547
Unauth. Reflected Cross-Site Scripting XSS vulnerability in WPFactory Products, Order & Customers Export for WooCommerce plugin = 2.0.7 versions...
CVE-2023-47514
Unauth. Reflected Cross-Site Scripting XSS vulnerability in lawrenceowen, gcubero, acunnningham, fmahmood Star CloudPRNT for WooCommerce plugin = 2.0.3 versions...
CVE-2023-47657
Auth. ShopManager+ Stored Cross-Site Scripting XSS vulnerability in GrandPlugins Direct Checkout – Quick View – Buy Now For WooCommerce plugin = 1.5.8 versions...
CVE-2023-2781
The User Email Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass via authenticateuserbyemail in versions up to, and including, 3.5.0. This is due to a random token generation weakness in the resendverificationemail function. This allows unauthenticated...
CVE-2023-2841
The Advanced Local Pickup for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the id parameter in versions up to, and including, 1.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This make...
CVE-2022-3459
The WooCommerce Multiple Free Gift plugin for WordPress is vulnerable to gift manipulation in all versions up to, and including, 1.2.3. This is due to plugin not enforcing server-side checks on the products that can be added as a gift. This makes it possible for unauthenticated attackers to add...
CVE-2022-1916
The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store WordPress plugin before 1.0.5 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action available to both unauthenticated and authenticated users, leading to a...
CVE-2022-2382
The Product Slider for WooCommerce WordPress plugin before 2.5.7 has flawed CSRF checks and lack authorisation in some of its AJAX actions, allowing any authenticated users, such as subscriber to call them. One in particular could allow them to delete arbitrary blog options...
CVE-2022-2575
The WBW Currency Switcher for WooCommerce WordPress plugin before 1.6.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...