CVE-2024-13750 Multilevel Referral Affiliate Plugin for WooCommerce <= 2.27 - Authenticated (Subscriber+) SQL Injection

The Multilevel Referral Affiliate Plugin for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.27 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2024-13750 Multilevel Referral Affiliate Plugin for WooCommerce <= 2.28 - Authenticated (Subscriber+) SQL Injection

The Multilevel Referral Affiliate Plugin for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.28 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

WordPress plugin SKU Generator for WooCommerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...

PT-2025-9149 · Woocommerce · Multilevel Referral Affiliate Plugin For Woocommerce

Name of the Vulnerable Software and Affected Versions: Multilevel Referral Affiliate Plugin for WooCommerce versions up to 2.27 Description: The issue allows authenticated attackers with Subscriber-level access and above to inject SQL queries, potentially extracting sensitive information from the...

WordPress plugin Multilevel Referral Affiliate Plugin for WooCommerce SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A SQL injection vulnerability exists in...

WordPress Multilevel Referral Affiliate Plugin for WooCommerce plugin <= 2.28 - SQL Injection vulnerability

SQL Injection vulnerability discovered by oncybersec in WordPress Plugin Multilevel Referral Affiliate Plugin for WooCommerce versions = 2.28...

CVE-2024-10860

The NextMove Lite – Thank You Page for WooCommerce plugin for WordPress is vulnerable to unauthorized submission of data due to a missing capability check on the submituninstallreasonaction function in all versions up to, and including, 2.19.0. This makes it possible for authenticated attackers,...

CVE-2024-10860

CVE-2024-10860 affects the WordPress plugin “NextMove Lite – Thank You Page for WooCommerce.” The vulnerability is a missing capability check in the _submit_uninstall_reason_action() function, present in all versions up to 2.19.0. This allows authenticated attackers with Subscriber-level access a...

CVE-2024-8425

The WooCommerce Ultimate Gift Card plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'mwbwgmpreviewmail' and 'mwbwgmwoocommerceaddcartitemdata' functions in all versions up to, and including, 2.6.0. This makes it possible for...

CVE-2024-8425

The WooCommerce Ultimate Gift Card plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'mwbwgmpreviewmail' and 'mwbwgmwoocommerceaddcartitemdata' functions in all versions up to, and including, 2.9.2. This makes it possible for...

CVE-2024-13831

The Tabs for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.0 via deserialization of untrusted input in the 'producthascustomtabs' function. This makes it possible for authenticated attackers, with Shop Manager-level access and...

CVE-2024-13638

The Order Attachments for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5.1 via the 'uploads' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the...

CVE-2024-13638

The CVE-2024-13638 entry concerns the WordPress plugin Order Attachments for WooCommerce. Affected versions are all up to and including 2.5.1, with exploitation via the uploads directory (/wp-content/uploads). The issue enables unauthenticated attackers to access sensitive data stored in attachme...

CVE-2024-13831 Tabs for WooCommerce <= 1.0.0 - Authentiated (Shop Manager+) PHP Object Injection in product_has_custom_tabs

The Tabs for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.0 via deserialization of untrusted input in the 'producthascustomtabs' function. This makes it possible for authenticated attackers, with Shop Manager-level access and...

CVE-2024-13638 Order Attachments for WooCommerce <= 2.5.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory

The Order Attachments for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5.1 via the 'uploads' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the...

EUVD-2024-53967

The WooCommerce Ultimate Gift Card plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'mwbwgmpreviewmail' and 'mwbwgmwoocommerceaddcartitemdata' functions in all versions up to, and including, 2.6.0. This makes it possible for...

CVE-2024-8425 WooCommerce Ultimate Gift Card <= 2.9.2 - Unauthenticated Arbitrary File Upload

The WooCommerce Ultimate Gift Card plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'mwbwgmpreviewmail' and 'mwbwgmwoocommerceaddcartitemdata' functions in all versions up to, and including, 2.9.2. This makes it possible for...

CVE-2024-8425

The CVE-2024-8425 entry concerns the WordPress WooCommerce Ultimate Gift Card plugin (versions up to 2.6.0). The root cause is insufficient file type validation in mwb_wgm_preview_mail and mwb_wgm_woocommerce_add_cart_item_data, allowing unauthenticated arbitrary file uploads to the server and po...

CVE-2024-10563

The WooCommerce Cart Count Shortcode WordPress plugin before 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site...

WordPress Order Attachments for WooCommerce plugin <= 2.5.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory vulnerability

Unauthenticated Sensitive Information Exposure Through Unprotected Directory vulnerability discovered by Tim Coen in WordPress Plugin Order Attachments for WooCommerce versions = 2.5.1...