CVE-2022-46858

CVE-2022-46858 affects the WordPress plugin Product Specifications for Woocommerce (Amin A. Rezapour) up to version 0.6.0 . The issue is an unauthenticated, reflected Cross-Site Scripting (XSS) via arbitrary query string parameters, enabling injected scripts when users visit a crafted URL. Public...

PT-2023-15066 · WordPress · Woocommerce Jazzcash Gateway Plugin

Name of the Vulnerable Software and Affected Versions: WooCommerce JazzCash Gateway Plugin versions prior to 2.1 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially...

PT-2023-15083 · Unknown · Woocommerce

Name of the Vulnerable Software and Affected Versions: Amin A.Rezapour Product Specifications for Woocommerce plugin versions 0.6.0 and earlier Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This allows for malicious scripts to be injected into a...

CVE-2023-22710

Unauth. Reflected Cross-Site Scripting XSS vulnerability in chilidevs Return and Warranty Management System for WooCommerce plugin = 1.2.3 versions...

CVE-2023-0948

The Japanized For WooCommerce WordPress plugin before 2.5.8 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting...

CVE-2023-0537

The Product Slider For WooCommerce Lite WordPress plugin through 1.1.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site...

PT-2023-13962 · WordPress · Bitcoin / Altcoin Payment Gateway For Woocommerce & Multivendor Store

Name of the Vulnerable Software and Affected Versions: Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop WordPress plugin versions 1.7.1 and earlier Description: The issue is related to a SQL injection problem. It occurs because a parameter is not properly sanitized and...

PT-2023-16343 · WordPress · Product Slider For Woocommerce

Name of the Vulnerable Software and Affected Versions: The Product Slider For WooCommerce Lite WordPress plugin versions 1.1.7 and earlier Description: The issue is related to the plugin not validating and escaping some of its shortcode attributes before outputting them back in a page/post where...

WordPress Points and Rewards for WooCommerce Plugin <= 1.5.0 is vulnerable to Settings Change

Software Points and Rewards for WooCommerce Type Plugin Vulnerable versions = 1.5.0 Fixed in 1.6.0 OWASP Top 10 A2: Broken Authentication Classification Settings Change CVE CVE-2023-27607 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 30461bd57ddb Credits Dave Jong...

CVE-2022-47449

Unauth. Reflected Cross-Site Scripting XSS vulnerability in RexTheme Cart Lift – Abandoned Cart Recovery for WooCommerce and EDD plugin = 3.1.5 versions...

CVE-2023-29170

Auth. admin+ Stored Cross-site Scripting XSS vulnerability in PI Websolution Product Enquiry for WooCommerce, WooCommerce product catalog plugin = 2.2.12 versions...

Cross site scripting

Auth. admin+ Stored Cross-site Scripting XSS vulnerability in PI Websolution Product page shipping calculator for WooCommerce plugin = 1.3.20 versions...

CVE-2023-29094 WordPress Product page shipping calculator for WooCommerce Plugin <= 1.3.20 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-site Scripting XSS vulnerability in PI Websolution Product page shipping calculator for WooCommerce plugin = 1.3.20 versions...

CVE-2023-29094

CVE-2023-29094 affects the WordPress plugin Product page shipping calculator for WooCommerce (PI Websolution), vulnerable in versions

PT-2023-22184 · Unknown · Woocommerce +1

Name of the Vulnerable Software and Affected Versions: PI Websolution Product Enquiry for WooCommerce versions 2.2.12 and earlier Description: The issue is related to a Stored Cross-site Scripting XSS vulnerability that requires authentication with admin+ privileges. This vulnerability affects th...

CVE-2022-46793

Cross-Site Request Forgery CSRF vulnerability in AdTribes.Io Product Feed PRO for WooCommerce plugin = 12.4.4 versions...

WordPress Product Enquiry for WooCommerce Plugin <= 2.2.12 is vulnerable to Cross Site Scripting (XSS)

Software Product Enquiry for WooCommerce Type Plugin Vulnerable versions = 2.2.12 Fixed in 2.2.13 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-29170 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID b43cae5ebb34 Credits Myung...

WordPress Direct checkout, Add to cart redirect for Woocommerce Plugin <= 2.1.48 is vulnerable to Cross Site Scripting (XSS)

Software Direct checkout, Add to cart redirect for Woocommerce Type Plugin Vulnerable versions = 2.1.48 Fixed in 2.1.49 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-28988 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID...

JustTables – WooCommerce Product Table < 1.5.0 - Cross-Site Request Forgery

The plugin does not adequately protect against CSRF attacks, leading to potential unauthorized actions...

Elementor Pro < 3.11.7 - Subscriber+ Arbitrary Options Update

The plugin does not have authorisation in an AJAX action relying only on a nonce, which is available to any authenticated users, and does not validate the options to be updated. This allows any authenticated users, such as subscriber to update arbitrary blog options, such as the defaultrole, when...