1980 matches found
CVE-2022-3986
The WP Stripe Checkout WordPress plugin before 1.2.2.21 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks...
CVE-2022-45070
Missing Authorization vulnerability in FmeAddons Conditional Checkout Fields for WooCommerce.This issue affects Conditional Checkout Fields for WooCommerce: from n/a through 1.2.3...
CVE-2018-11633
An issue was discovered in the MULTIDOTS Woo Checkout for Digital Goods plugin 2.1 for WordPress. If an admin user can be tricked into visiting a crafted URL created by an attacker via spear phishing/social engineering, the attacker can change the plugin settings. The function...
CVE-2019-7939
A reflected cross-site scripting vulnerability exists on the customer cart checkout page of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by sending a victim a crafted URL that results in malicious javascript execution in the victim's...
CVE-2019-14979
cgi-bin/webscr?cmd=cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.17 for WordPress allows Parameter Tampering in an amount parameter such as amount1, as demonstrated by purchasing an item for lower than the intended price. NOTE: The plugin author states it is true that the...
CVE-2011-5238
google-checkout-php-sample-code before 1.3.2 does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...
CVE-2009-5059
Unspecified vulnerability in IBM Lotus Quickr 8.1 before 8.1.0.10 services for Lotus Domino might allow remote authenticated users to cause a denial of service daemon crash by checking out a document that is accessed through a connector, aka SPR MMOI7PSR8J...
CVE-2025-47504
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPFactory Custom Checkout Fields for WooCommerce custom-checkout-fields-for-woocommerce allows Stored XSS.This issue affects Custom Checkout Fields for WooCommerce: from n/a through = 1.8.3...
CVE-2025-47685
Cross-Site Request Forgery CSRF vulnerability in Moloni Contribuinte Checkout contribuinte-checkout allows Stored XSS.This issue affects Contribuinte Checkout: from n/a through = 2.0.03...
WordPress Contribuinte Checkout plugin <= 2.0.03 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability
Cross Site Request Forgery CSRF to Stored XSS vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Contribuinte Checkout versions = 2.0.03...
CVE-2025-47685
Cross-Site Request Forgery CSRF vulnerability in Moloni Contribuinte Checkout contribuinte-checkout allows Stored XSS.This issue affects Contribuinte Checkout: from n/a through = 2.0.03...
CVE-2025-47592
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Árpád Lehel Mátyus Terms Popup On User Login terms-popup-on-user-login allows Stored XSS.This issue affects Terms Popup On User Login: from n/a through = 2.0.8...
CVE-2025-47685
CVE-2025-47685 affects the WordPress plugin Contribuinte Checkout (versions up to and including 2.0.02). It combines CSRF to enable Stored XSS in the plugin. The CVSS v3.1 base score is 7.1 (HIGH) with network attack vector, requiring user interaction, and impacts to confidentiality, integrity, a...
CVE-2025-47685 WordPress Contribuinte Checkout plugin <= 2.0.02 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability
Cross-Site Request Forgery CSRF vulnerability in Moloni Contribuinte Checkout allows Stored XSS. This issue affects Contribuinte Checkout: from n/a through 2.0.02...
CVE-2025-47592
CVE-2025-47592 refers to a stored XSS in the WordPress plugin Terms Popup On User Login (TPUL) for User Login and WooCommerce Checkout. Root cause: improper input neutralization during web page generation. Affected versions: TPUL <= 2.0.3 (n/a through 2.0.3). Impact: stored Cross-Site Scriptin...
CVE-2025-47504
CVE-2025-47504 documents a stored XSS in two WordPress WooCommerce plugins: Custom Checkout Fields for WooCommerce (affected <=1.8.3) and Email Verification for WooCommerce (affected
WordPress Custom Checkout Fields for WooCommerce plugin <= 1.8.3 - Cross Site Scripting (XSS) Vulnerability
Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin Custom Checkout Fields for WooCommerce versions = 1.8.3...
PT-2025-20169 · Unknown · Lehel Mátyus Legal Terms/Conditions Popup For User Login/Woocommerce Checkout
Name of the Vulnerable Software and Affected Versions: Lehel Mátyus Legal Terms and Conditions Popup for User Login and WooCommerce Checkout – TPUL versions 2.0.3 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored...
WordPress plugin Custom Checkout Fields for WooCommerce 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
WordPress plugin Legal Terms and Conditions Popup for User Login and WooCommerce Checkout – TPUL 跨站脚本漏洞
WordPress and the WordPress plugin are products of the WordPress Foundation, a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. WordPress plugin Legal Terms and Conditions Popup for User Login and...