WordPress XStore Core plugin <= 5.3.8 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin XStore Core versions = 5.3.8...

VulnCheck KEV: CVE-2024-33551

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in 8theme XStore Core allows SQL Injection.This issue affects XStore Core: from n/a through 5.3.5...

WordPress XStore Theme <= 9.3.8 is vulnerable to SQL Injection

Software XStore Type Theme Vulnerable versions = 9.3.8 Fixed in 9.3.9 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-33559 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 0996b4472188 Credits Rafie Muhammad Patchstack Required privilege...

WordPress XStore Core Plugin <= 5.3.8 is vulnerable to SQL Injection

Software XStore Core Type Plugin Vulnerable versions = 5.3.8 Fixed in 5.3.9 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-33551 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 2d04569c89eb Credits Rafie Muhammad Patchstack Required privilege...

WordPress XStore Core Plugin <= 5.3.8 is vulnerable to Broken Access Control

Software XStore Core Type Plugin Vulnerable versions = 5.3.8 Fixed in 5.3.9 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-33555 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 1c391075b80a Credits Rafie Muhammad Patchstack...

PT-2024-4545 · 8Theme · 8Theme Xstore

Name of the Vulnerable Software and Affected Versions: 8theme XStore versions n/a through 9.3.5 Description: The issue is related to improper neutralization of special elements used in an SQL command, which allows SQL injection. This can enable a remote attacker to execute arbitrary SQL queries t...

WordPress XStore Core Plugin <= 5.3.8 is vulnerable to PHP Object Injection

Software XStore Core Type Plugin Vulnerable versions = 5.3.8 Fixed in 5.3.9 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-33553 Patch priority High CVSS severity High 9 Developer Claim ownership PSID 49ab51cfb6ce Credits Rafie Muhammad Patchstack Required privilege...

WordPress XStore Core Plugin <= 5.3.8 is vulnerable to Cross Site Scripting (XSS)

Software XStore Core Type Plugin Vulnerable versions = 5.3.8 Fixed in 5.3.9 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-33554 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID c7395c437d4a Credits Rafie Muhammad Patchstack Required...

WordPress XStore Theme <= 9.3.8 is vulnerable to Broken Access Control

Software XStore Type Theme Vulnerable versions = 9.3.8 Fixed in 9.3.9 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-33561 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID b6ec6d6c7945 Credits Rafie Muhammad Patchstack Required...

WordPress XStore Theme <= 9.3.8 is vulnerable to Broken Access Control

Software XStore Type Theme Vulnerable versions = 9.3.8 Fixed in 9.3.9 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-33563 Patch priority High CVSS severity High 7.6 Developer Claim ownership PSID b054c7b1c33a Credits Rafie Muhammad Patchstack Required...

WordPress XStore Theme <= 9.3.8 is vulnerable to Local File Inclusion

Software XStore Type Theme Vulnerable versions = 9.3.8 Fixed in 9.3.9 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-33560 Patch priority High CVSS severity High 9 Developer Claim ownership PSID 6dff12fe54af Credits Rafie Muhammad Patchstack Required privilege...

VulnCheck KEV: CVE-2024-33552

Improper Privilege Management vulnerability in 8theme XStore Core allows Privilege Escalation.This issue affects XStore Core: from n/a through 5.3.8...

WordPress XStore Core Plugin <= 5.3.8 is vulnerable to Arbitrary File Download

Software XStore Core Type Plugin Vulnerable versions = 5.3.8 Fixed in 5.3.9 OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Download CVE CVE-2024-33558 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID 535d5071f992 Credits Rafie Muhammad Patchstack...

WordPress XStore Core Plugin <= 5.3.8 is vulnerable to Arbitrary File Upload

Software XStore Core Type Plugin Vulnerable versions = 5.3.8 Fixed in 5.3.9 OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Upload CVE CVE-2024-33556 Patch priority High CVSS severity High 8.2 Developer Claim ownership PSID 108b732f3dae Credits Rafie Muhammad Patchstack...

WordPress XStore Theme <= 9.3.8 is vulnerable to Cross Site Scripting (XSS)

Software XStore Type Theme Vulnerable versions = 9.3.8 Fixed in 9.3.9 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-33562 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 5d1626b7824f Credits Rafie Muhammad Patchstack Required privile...

WordPress XStore Core Plugin <= 5.3.8 is vulnerable to Privilege Escalation

Software XStore Core Type Plugin Vulnerable versions = 5.3.8 Fixed in 5.3.9 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2024-33552 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID d1199dede4c1 Credits Rafie...

VulnCheck KEV: CVE-2024-33553

Deserialization of Untrusted Data vulnerability in 8theme XStore Core.This issue affects XStore Core: from n/a through 5.3.5...

WordPress XStore Theme <= 9.3.8 is vulnerable to Settings Change

Software XStore Type Theme Vulnerable versions = 9.3.8 Fixed in 9.3.9 OWASP Top 10 A1: Broken Access Control Classification Settings Change CVE CVE-2024-33564 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID fefe041fa298 Credits Rafie Muhammad Patchstack Required privileg...

WordPress XStore Core Plugin <= 5.3.8 is vulnerable to Local File Inclusion

Software XStore Core Type Plugin Vulnerable versions = 5.3.8 Fixed in 5.3.9 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-33557 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 942a9619d048 Credits Rafie Muhammad Patchstack Required privilege...

The vulnerability of the Java library Apache PDFBox in the Oracle Retail Xstore Point of Service software allows a hacker to cause service interruptions.

The vulnerability of the Java library Apache PDFBox in the Oracle Retail Xstore Point of Service software lies in insufficient validation of input data. Exploiting this vulnerability can allow attackers to cause service failures using specially created malicious PDF files...