Cross site request forgery (csrf)

The WooCommerce PDF Invoice Builder for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the SaveCustomField function in versions up to, and including, 1.2.90. This makes it possible for unauthenticated attackers to create invoice fields provided they can tric...

Cross site request forgery (csrf)

The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.90. This is due to missing or incorrect nonce validation on the Save function. This makes it possible for unauthenticated attackers to make changes to invoice...

CVE-2023-3764

CVE-2023-3764 concerns the WooCommerce PDF Invoice Builder plugin for WordPress. The issue is a Cross-Site Request Forgery (CSRF) vulnerability in the Save function, allowing unauthenticated attackers to trigger changes to invoices if a site admin is tricked into performing an action. Affected ve...

CVE-2023-2188

The CVE-2023-2188 entry concerns the WordPress Colibri Page Builder plugin. Affected software: Colibri Page Builder for WordPress, versions up to and including 1.0.227. Root cause: insufficient escaping of the post_id parameter and inadequate preparation of the existing SQL query, enabling SQL In...

CVE-2023-2188 Colibri Page Builder <= 1.0.227 - Authenticated (Administrator+) SQL Injection via post_id

The Colibri Page Builder for WordPress is vulnerable to SQL Injection via the ‘postid’ parameter in versions up to, and including, 1.0.227 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2023-2188 Colibri Page Builder <= 1.0.227 - Authenticated (Administrator+) SQL Injection via post_id

The Colibri Page Builder for WordPress is vulnerable to SQL Injection via the ‘postid’ parameter in versions up to, and including, 1.0.227 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2023-4160

CVE-2023-4160 affects the WooCommerce PDF Invoice Builder plugin for WordPress, with Stored Cross-Site Scripting via admin settings in versions up to and including 1.2.90. The vulnerability arises from insufficient input sanitization and output escaping, enabling authenticated attackers with admi...

CVE-2023-4160 WooCommerce PDF Invoice Builder <= 1.2.90 - Authenticated (Administrator+) Cross-Site Scripting

The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.2.90 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-leve...

CVE-2023-4160 WooCommerce PDF Invoice Builder <= 1.2.90 - Authenticated (Administrator+) Cross-Site Scripting

The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.2.90 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-leve...

CVE-2023-4161

CVE-2023-4161 concerns the WordPress plugin WooCommerce PDF Invoice Builder . Multiple sources confirm a Cross‑Site Request Forgery (CSRF) vulnerability caused by a missing nonce check in the SaveCustomField function, affecting versions up to and including 1.2.90. Unauthenticated attackers could ...

CVE-2023-4161 WooCommerce PDF Invoice Builder <= 1.2.90 - Cross-Site Request Forgery to Custom Field Creation

The WooCommerce PDF Invoice Builder for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the SaveCustomField function in versions up to, and including, 1.2.90. This makes it possible for unauthenticated attackers to create invoice fields provided they can tric...

CVE-2023-3677

CVE-2023-3677 affects the WooCommerce PDF Invoice Builder plugin for WordPress (versions

CVE-2023-3677 WooCommerce PDF Invoice Builder <= 1.2.89 - Authenticated (Subscriber+) SQL Injection via Export

The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to SQL Injection via the pageId parameter in versions up to, and including, 1.2.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possibl...

CVE-2023-0689 Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_first_name' shortcode

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mffirstname' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about arbitrar...

CVE-2023-4245

The CVE-2023-4245 issue affects the WooCommerce PDF Invoice Builder for WordPress (versions up to 1.2.89). Root cause: missing capability check in GetInvoiceDetail, enabling unauthorized access to invoices by subscribers who can guess order and invoice IDs. Impact stated in sources is unauthorize...

PT-2023-28350 · WordPress · Woocommerce Pdf Invoice Builder

Name of the Vulnerable Software and Affected Versions: WooCommerce PDF Invoice Builder for WordPress versions up to, and including, 1.2.89 Description: The issue allows unauthorized access to data due to a missing capability check on the GetInvoiceDetail function. This makes it possible for...

WordPress plugin WooCommerce PDF Invoice Builder 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports PHP and MySQL servers to set up a personal blog site. WordPress plugin is an application plugin. WordPress plugin WooCommerce PDF...

PT-2023-27993 · WordPress · Woocommerce Pdf Invoice Builder

Name of the Vulnerable Software and Affected Versions: WooCommerce PDF Invoice Builder plugin for WordPress versions up to, and including, 1.2.90 Description: The issue is related to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. This...

WordPress plugin WooCommerce PDF Invoice Builder SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports PHP and MySQL server set up a personal blog site. WordPress plugin is an application plugin. WordPress plugin WooCommerce PDF Invoi...

WordPress plugin WooCommerce PDF Invoice Builder 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports PHP and MySQL servers to set up a personal blog site. WordPress plugin is an application plugin. WordPress plugin WooCommerce PDF...