WordPress YITH Maintenance Mode plugin <= 1.3.7 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Asif Nawaz Minhas Patchstack Red Team in WordPress YITH Maintenance Mode plugin versions = 1.3.7. Vulnerable parameter: &yithmaintenancenewslettersubmitlabel. Solution Update the WordPress YITH Maintenance Mode plugin to th...

YITH Request a Quote for WooCommerce < 1.6.4 - Unauthorised AJAX call via CSRF

The ajax method did not properly check for CSRF, allowing attackers to make users call the ajaxadditem, ajaxremoveitem or ajaxvariationexist actions, which will tamper with their session quote. POST /wp-admin/admin-ajax.php HTTP/1.1 Accept: application/json, text/javascript, /; q=0.01...

YITH Request a Quote for WooCommerce < 1.6.4 - Unauthorised AJAX call via CSRF

The ajax method did not properly check for CSRF, allowing attackers to make users call the ajaxadditem, ajaxremoveitem or ajaxvariationexist actions, which will tamper with their session quote. PoC POST /wp-admin/admin-ajax.php HTTP/1.1 Accept: application/json, text/javascript, /; q=0.01...

WordPress YITH WooCommerce Gift Cards plugin <= 3.3.0 - Arbitrary File Upload to Remote Code Execution (RCE) vulnerability

Arbitrary File Upload to Remote Code Execution RCE vulnerability found by Guy Liu in WordPress YITH WooCommerce Gift Cards plugin versions = 3.3.0. Solution Update the WordPress YITH WooCommerce Gift Cards plugin to the latest available version at least 3.3.1...

WooCommerce for WordPress Remote Code Execution Vulnerability

Automattic WooCommerce is the United States Automattic company's set of open source e-commerce platform based on WordPress . A security vulnerability exists in YITH WooCommerce Gift Cards Premium plugin before 3.3.1 for WordPress, which can be exploited by remote attackers to achieve remote code...

YITH WooCommerce Gift Cards Premium < 3.3.1 - RCE via Arbitrary File Upload

"An arbitrary file upload vulnerability in the YITH WooCommerce Gift Cards Premium before 3.3.1 allows remote attackers to achieve remote code execution on the operating system in the security context of the web server. In order to exploit this vulnerability, an attacker must be able to place a...

CVE-2021-3120

An arbitrary file upload vulnerability in the YITH WooCommerce Gift Cards Premium plugin before 3.3.1 for WordPress allows remote attackers to achieve remote code execution on the operating system in the security context of the web server. In order to exploit this vulnerability, an attacker must ...

CVE-2021-3120

An arbitrary file upload vulnerability in the YITH WooCommerce Gift Cards Premium plugin before 3.3.1 for WordPress allows remote attackers to achieve remote code execution on the operating system in the security context of the web server. In order to exploit this vulnerability, an attacker must ...

Design/Logic Flaw

An arbitrary file upload vulnerability in the YITH WooCommerce Gift Cards Premium plugin before 3.3.1 for WordPress allows remote attackers to achieve remote code execution on the operating system in the security context of the web server. In order to exploit this vulnerability, an attacker must ...

CVE-2021-3120

An arbitrary file upload vulnerability in the YITH WooCommerce Gift Cards Premium plugin before 3.3.1 for WordPress allows remote attackers to achieve remote code execution on the operating system in the security context of the web server. In order to exploit this vulnerability, an attacker must ...

CVE-2021-3120

CVE-2021-3120 affects the WordPress plugin YITH WooCommerce Gift Cards Premium (versions prior to 3.3.1). The vulnerability is an arbitrary file upload leading to RCE , triggered when a valid Gift Card product is added to the cart and the parameter ywgc-upload-picture accepts a PHP file, storing ...

WooCommerce for WordPress 代码问题漏洞

Automattic WooCommerce is the United States Automattic company's set of open source e-commerce platform based on WordPress . A security vulnerability exists in YITH WooCommerce Gift Cards Premium plugin before 3.3.1 for WordPress, which can be exploited by remote attackers to achieve remote code...

YITH WooCommerce Ajax Product Filter Plugin for WordPress < 3.11.1 Cross-Site Scripting

The WordPress YITH WooCommerce Ajax Product Filter Plugin installed on the remote host is affected by a Cross-Site Scripting XSS vulnerability. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source data...

YITH WooCommerce Ajax Product Filter < 3.11.1 - Authenticated Reflected Cross-Site Scripting (XSS)

The YITH WooCommerce Ajax Product Filter WordPress plugin was affected by an Authenticated Reflected Cross-Site Scripting XSS vulnerability in an admin form. The vulnerability was fixed in version 3.11.1 of the plugin...

WordPress YITH WooCommerce Ajax Product Filter plugin <= 3.11.0 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability

Authenticated Reflected Cross-Site Scripting XSS vulnerability found by John Castro in WordPress YITH WooCommerce Ajax Product Filter plugin versions = 3.11.0. Solution Update the WordPress YITH WooCommerce Ajax Product Filter plugin to the latest available version at least 3.11.1...

WordPress YITH Pre-Order for WooCommerce plugin <= 1.2.0 - Authenticated Settings Change (YITH Plugin Framework <=3.3.8) vulnerability

Authenticated Settings Change YITH Plugin Framework =3.3.8 vulnerability found by Jerome Bruandet in WordPress YITH Pre-Order for WooCommerce plugin versions = 1.2.0. Solution Update the WordPress YITH Pre-Order for WooCommerce plugin to the latest available version at least 1.2.1...

WordPress YITH WooCommerce Product Add-Ons plugin <=1.5.21 - Authenticated Settings Change (YITH Plugin Framework <=3.3.8) vulnerability

Authenticated Settings Change YITH Plugin Framework =3.3.8 vulnerability found by Jerome Bruandet in WordPress YITH WooCommerce Product Add-Ons plugin versions =1.5.21. Solution Update the WordPress YITH WooCommerce Product Add-Ons plugin to the latest available version at least 1.5.23...

WordPress YITH WooCommerce Affiliates plugin <=1.6.2 - Authenticated Settings Change (YITH Plugin Framework <=3.3.8) vulnerability

Authenticated Settings Change YITH Plugin Framework =3.3.8 vulnerability found by Jerome Bruandet in WordPress YITH WooCommerce Affiliates plugin versions =1.6.2. Solution Update the WordPress YITH WooCommerce Affiliates plugin to the latest available version at least 1.6.3...

WordPress YITH WooCommerce Request A Quote plugin <=1.4.8 - Authenticated Settings Change (YITH Plugin Framework <=3.3.8) vulnerability

Authenticated Settings Change YITH Plugin Framework =3.3.8 vulnerability found by Jerome Bruandet in WordPress YITH WooCommerce Request A Quote plugin versions =1.4.8. Solution Update the WordPress YITH WooCommerce Request A Quote plugin to the latest available version at least 1.4.9...

WordPress YITH WooCommerce Added to Cart Popup plugin <=1.3.12 - Authenticated Settings Change (YITH Plugin Framework <=3.3.8) vulnerability

Authenticated Settings Change YITH Plugin Framework =3.3.8 vulnerability found by Jerome Bruandet in WordPress YITH WooCommerce Added to Cart Popup plugin versions =1.3.12. Solution Update the WordPress YITH WooCommerce Added to Cart Popup plugin to the latest available version at least =1.3.13...