CVE-2024-8788

The EU/UK VAT Manager for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 2.12.11. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2024-8788

Summary: CVE-2024-8788 affects the EU/UK VAT Manager for WooCommerce plugin for WordPress, with reflected XSS caused by insufficient escaping of add_query_arg usage. Affected versions are up to 2.12.11; exploitation is unauthenticated and requires user interaction (e.g., the target user clicking ...

WordPress plugin EU/UK VAT Manager for WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPress...

PT-2024-39478 · WordPress · Eu/Uk Vat Manager For Woocommerce

Name of the Vulnerable Software and Affected Versions: EU/UK VAT Manager for WooCommerce plugin for WordPress versions up to, and including, 2.12.12 Description: The issue allows unauthorized modification of data due to a missing capability check on the alg wc eu vat exempt vat from admin functio...

CVE-2024-8872

The Store Hours for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 4.3.20. This makes it possible for unauthenticated attackers to inject arbitrary web...

WordPress plugin Store Hours for WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability exists in...

WordPress Store Hours for WooCommerce Plugin <= 4.3.20 is vulnerable to Cross Site Scripting (XSS)

Software Store Hours for WooCommerce Type Plugin Vulnerable versions = 4.3.20 Fixed in 4.3.22 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8872 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 68b70cba0cc7 Credits vgo0...

WordPress Revolut Gateway for WooCommerce plugin <= 4.17.3 - Missing Authorization to Unauthenticated Order Status Update vulnerability

Missing Authorization to Unauthenticated Order Status Update vulnerability discovered by WordFence in WordPress Plugin Revolut Gateway for WooCommerce versions = 4.17.3...

CVE-2024-8678

The Revolut Gateway for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wc/v3/revolut REST API endpoint in all versions up to, and including, 4.17.3. This makes it possible for unauthenticated attackers to mark orders a...

CVE-2024-7491

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.6.1 via the woofmessengerremovesubscr AJAX action due to missing validation on the 'key' user controlled key. This makes it...

WordPress plugin Revolut Gateway for WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A security vulnerability exists in...

CVE-2024-8716

The XT Ajax Add To Cart for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2024-8716

The XT Ajax Add To Cart for WooCommerce plugin (WordPress) is affected by CVE-2024-8716: Reflected Cross-Site Scripting due to improper escaping of add_query_arg in the URL for all versions up to 1.1.2. The vulnerability is exploitable by unauthenticated attackers who can entice a user to perform...

WordPress XT Ajax Add To Cart for WooCommerce plugin <= 1.1.2 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin XT Ajax Add To Cart for WooCommerce versions = 1.1.2...

PT-2024-39172 · WordPress · Revolut Gateway For Woocommerce

Name of the Vulnerable Software and Affected Versions: Revolut Gateway for WooCommerce plugin for WordPress versions up to, and including, 4.17.3 Description: The issue is related to unauthorized modification of data due to a missing capability check on the "/wc/v3/revolut" REST API endpoint. Thi...

PT-2024-39196 · WordPress · Xt Ajax Add To Cart For Woocommerce

Name of the Vulnerable Software and Affected Versions: XT Ajax Add To Cart for WooCommerce plugin for WordPress versions up to, and including, 1.1.2 Description: The issue is related to Reflected Cross-Site Scripting due to the use of add query arg without appropriate escaping on the URL. This...

WordPress Product Carousel Slider & Grid Ultimate for WooCommerce plugin <= 1.9.10 - Authenticated Local File Inclusion vulnerability

Authenticated Local File Inclusion vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin Product Carousel Slider & Grid Ultimate for WooCommerce versions = 1.9.10...

The vulnerability of the InPost plugins for WooCommerce and the InPost PL plugin for WordPress allows a hacker to execute arbitrary code.

The vulnerability of InPost plugins for WooCommerce and the InPost PL plugin for WordPress involves a lack of authentication. Exploiting this vulnerability allows a malicious actor to execute arbitrary code...

PT-2024-31649 · Pickplugins · Pickplugins Product Slider For Woocommerce

Name of the Vulnerable Software and Affected Versions: PickPlugins Product Slider for WooCommerce versions 1.13.50 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS,...

CVE-2024-8271

The The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.4.2.1. This is due to the software allowing users to execute an action that does not properly validate a value before running...