CVE-2024-11809

The Primer MyData for Woocommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'imgsrc' parameter in all versions up to, and including, 4.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

WordPress plugin Check Pincode For Woocommerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting vulnerabili...

WordPress plugin Category Slider for WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-11737 · Woocommerce · Print Invoice & Delivery Notes For Woocommerce

Name of the Vulnerable Software and Affected Versions: Print Invoice & Delivery Notes for WooCommerce versions n/a through 4.7.2 Description: The issue is related to a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This can lea...

CVE-2024-12040 Product Carousel Slider & Grid Ultimate for WooCommerce <= 1.9.10 - Authenticated (Contributor+) Local File Inclusion via 'theme'

The Product Carousel Slider & Grid Ultimate for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9.10 via the 'theme' attribute of the wcpcsu shortcode. This makes it possible for authenticated attackers, with Contributor-level access...

PT-2024-17463 · WordPress · Seraphinite Bulk Discounts For Woocommerce

Name of the Vulnerable Software and Affected Versions: Seraphinite Bulk Discounts for WooCommerce plugin for WordPress versions up to, and including, 2.4.6 Description: The issue is related to Reflected Cross-Site Scripting due to the use of add query arg without proper escaping on the URL. This...

CVE-2024-12004 WPC Order Notes for WooCommerce <= 1.5.2 - Cross-Site Request Forgery to Reflected Cross-Site Scripting

The WPC Order Notes for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.2. This is due to missing or incorrect nonce validation on the ajaxupdateordernote function. This makes it possible for unauthenticated attackers to injec...

CVE-2024-12004

CVE-2024-12004 affects WPC Order Notes for WooCommerce (WordPress). The issue is Cross-Site Request Forgery due to missing/incorrect nonce validation in ajax_update_order_note(), enabling unauthenticated attackers to induce an admin action that could inject script. The CVE is considered active pe...

CVE-2024-10959

The The Active Products Tables for WooCommerce. Use constructor to create tables plugin for WordPress is vulnerable to arbitrary shortcode execution via wootgetsmth AJAX action in all versions up to, and including, 1.0.6.5. This is due to the software allowing users to execute an action that does...

CVE-2024-10959

CVE-2024-10959 details (Wordfence/Red Hat source): Affected software is the WordPress plugin Active Products Tables for WooCommerce. Use constructor to create tables . The vulnerability is an unauthenticated arbitrary shortcode execution via the woot_get_smth AJAX action, caused by executing do_s...

WordPress plugin Active Products Tables for WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

CVE-2023-30479

Missing Authorization vulnerability in Stamped.io Stamped.io Product Reviews & UGC for WooCommerce stampedio-product-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stamped.io Product Reviews & UGC for WooCommerce: from n/a through = 2.3.2...

CVE-2024-54227 WordPress Minimum and Maximum Quantity for WooCommerce plugin <= 2.0.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in theDotstore Minimum and Maximum Quantity for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Minimum and Maximum Quantity for WooCommerce: from n/a through 2.0.0...

CVE-2024-54227 WordPress Minimum and Maximum Quantity for WooCommerce plugin <= 2.0.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Dotstore Minimum and Maximum Quantity for WooCommerce min-and-max-quantity-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Minimum and Maximum Quantity for WooCommerce: from n/a through = 2.0.0...

CVE-2023-25026 WordPress PayPal Brasil para WooCommerce plugin <= 1.4.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Otávio Augusto PayPal Brasil para WooCommerce paypal-brasil-para-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PayPal Brasil para WooCommerce: from n/a through = 1.4.2...

CVE-2023-49194 WordPress Importify (Dropshipping WooCommerce) plugin <= 1.0.4 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Debugging Code vulnerability in importify Importify Dropshipping WooCommerce importify allows Retrieve Embedded Sensitive Data.This issue affects Importify Dropshipping WooCommerce: from n/a through = 1.0.4...

CVE-2023-51357 WordPress Track Google Analytics 4, Facebook Pixel & Conversions API via Google Tag Manager for WooCommerce plugin <= 6.5.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Conversios Conversios.io enhanced-e-commerce-for-woocommerce-store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Conversios.io: from n/a through = 6.5.0...

Malicious code in eslint-plugin-woocommerce (npm)

--- -= Per source details. Do not edit below this line.=-...

PT-2024-13691 · Woocommerce · Importify

Name of the Vulnerable Software and Affected Versions: Importify Dropshipping WooCommerce versions 1.0.0 through 1.0.4 Description: The issue allows the retrieval of embedded sensitive data due to the insertion of sensitive information into debugging code. Recommendations: For versions 1.0.0...

CVE-2024-12257

CVE-2024-12257 : CardGate Payments for WooCommerce (WordPress) is affected by a Reflected Cross-Site Scripting via the page parameter in all versions up to 3.2.1 due to insufficient input sanitization and output escaping. Unauthenticated attackers can trigger script execution in pages when a user...