CVE-2024-10436

CVE-2024-10436 affects the WPC Smart Messages for WooCommerce WordPress plugin, with Local File Inclusion via the get_condition_value function in all versions up to and including 4.2.1. Authenticated attackers with Subscriber-level access or higher can include and execute arbitrary PHP files on t...

WordPress plugin Sudan Payment Gateway for WooCommerce 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in the...

PT-2024-16282 · WordPress · Wpc Smart Messages

Name of the Vulnerable Software and Affected Versions: WPC Smart Messages for WooCommerce plugin for WordPress versions up to, and including, 4.2.1 Description: The issue allows authenticated attackers with Subscriber-level access and above to activate or deactivate smart messages due to a missin...

PT-2024-16281 · WordPress · Wpc Smart Messages

Name of the Vulnerable Software and Affected Versions: WPC Smart Messages for WooCommerce plugin for WordPress versions up to, and including, 4.2.1 Description: The issue allows authenticated attackers with Subscriber-level access and above to include and execute arbitrary files on the server via...

CVE-2024-50447 WordPress Envo's Elementor Templates & Widgets for WooCommerce plugin <= 1.4.19 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in EnvoThemes Envo's Elementor Templates & Widgets for WooCommerce envo-elementor-for-woocommerce allows Stored XSS.This issue affects Envo's Elementor Templates & Widgets for WooCommerce: from n/a...

WordPress AR For Woocommerce plugin <= 6.3 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin AR For Woocommerce versions = 6.3...

CVE-2024-9214 Extra Product Options Builder for WooCommerce <= 1.2.133 - Unauthenticated Stored Cross-Site Scripting

The Extra Product Options Builder for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'RednaoSerializedFields' parameter during the creation of a signature file in all versions up to, and including, 1.2.133 due to insufficient input sanitization and output...

WordPress Envo's Elementor Templates & Widgets for WooCommerce plugin <= 1.4.19 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin Envo's Elementor Templates & Widgets for WooCommerce versions = 1.4.19...

WordPress WPC Shop as a Customer for WooCommerce plugin <= 1.2.6 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin WPC Shop as a Customer for WooCommerce versions = 1.2.6...

WordPress Extra Product Options Builder for WooCommerce plugin <= 1.2.133 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Aitor F kr0no in WordPress Plugin Extra Product Options Builder for WooCommerce versions = 1.2.133...

WordPress plugin Extra Product Options Builder for WooCommerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2024-47634

Cross-Site Request Forgery CSRF vulnerability in Streamline.Lv CartBounty – Save and recover abandoned carts for WooCommerce allows Cross Site Request Forgery.This issue affects CartBounty – Save and recover abandoned carts for WooCommerce: from n/a through 8.2...

WordPress plugin EU/UK VAT Manager for WooCommerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...

CVE-2024-48047 WordPress Linked Variation for WooCommerce plugin <= 1.0.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Razon Komar Pal Linked Variation for WooCommerce linked-variation-for-woocommerce allows Cross Site Request Forgery.This issue affects Linked Variation for WooCommerce: from n/a through = 1.0.5...

PT-2024-33382 · Cmssoft · Cmssoft Csv Product Import Export For Woocommerce

Name of the Vulnerable Software and Affected Versions: cmssoft CSV Product Import Export for WooCommerce versions 1.0.0 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL...

PT-2024-33444 · Wpfactory · Wpfactory Email Verification For Woocommerce

Name of the Vulnerable Software and Affected Versions: WPFactory Email Verification for WooCommerce versions n/a through 2.8.10 Description: The issue is related to an SQL Injection vulnerability, specifically an Improper Neutralization of Special Elements used in an SQL Command. This allows...

CVE-2024-8541

The Discount Rules for WooCommerce – Create Smart WooCommerce Coupons & Discounts, Bulk Discount, BOGO Coupons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 2.6.5. Th...

WordPress Customer Email Verification for WooCommerce plugin <= 2.8.10 - SQL Injection vulnerability

SQL Injection vulnerability discovered by shaman0x01 Patchstack Alliance in WordPress Plugin Email Verification for WooCommerce versions = 2.8.10...

WordPress WooCommerce Plugin <= 9.0.2 is vulnerable to Content Injection

Software WooCommerce Type Plugin Vulnerable versions = 9.0.2 Fixed in 9.1.0 OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2024-9944 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID b045fb73bcc4 Credits drop Required privilege Unauthenticated Published ...

PT-2024-39082 · WordPress · Discount Rules For Woocommerce

Name of the Vulnerable Software and Affected Versions: The Discount Rules for WooCommerce – Create Smart WooCommerce Coupons & Discounts, Bulk Discount, BOGO Coupons plugin for WordPress versions up to, and including, 2.6.5 Description: The issue is related to Reflected Cross-Site Scripting due t...