CVE-2025-7642

CVE-2025-7642 affects the WordPress plugin Simpler Checkout, with authentication bypass in versions 0.7.0–1.1.9 due to improper identity verification in the simplerwc_woocommerce_order_created() flow, allowing unauthenticated attackers to log in as other users (potential admin if a test admin ord...

CVE-2025-6025

The Order Tip for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Improper Input Validation in all versions up to, and including, 1.5.4. This is due to lack of server-side validation on the data-tip attribute, which makes it possible for unauthenticated attackers to apply an...

CVE-2025-6025

CVE-2025-6025 concerns the Order Tip for WooCommerce plugin (WordPress) with unauthenticated input validation failure on the data-tip attribute, affecting all versions up to 1.5.4. The issue enables callers to submit tip values (including negative amounts) that can yield unauthorized discounts, p...

WordPress WooCommerce Purchase Orders plugin Arbitrary File Deletion Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. The WordPress WooCommerce Purchase Orders plugin suffers from an arbitrary file deletion vulnerability that stems from the program failing to properly filter for special element...

PT-2025-33427 · WordPress · Order Tip For Woocommerce

Name of the Vulnerable Software and Affected Versions: Order Tip for WooCommerce versions up to and including 1.5.4 Description: The Order Tip for WooCommerce plugin for WordPress is susceptible to improper input validation. The lack of server-side validation on the data-tip attribute allows...

MAL-2025-33433 Malicious code in sls-wallet-orders (npm)

The package sls-wallet-orders was found to contain malicious code...

Malicious code in imd-cloud-orders (npm)

The package imd-cloud-orders was found to contain malicious code...

MAL-2025-22024 Malicious code in gt.module.shipping-orders (npm)

The package gt.module.shipping-orders was found to contain malicious code...

Malicious code in gt.module.shipping-orders (npm)

The package gt.module.shipping-orders was found to contain malicious code...

Malicious code in sls-wallet-orders (npm)

The package sls-wallet-orders was found to contain malicious code...

Malicious code in ctech-orders-component (npm)

The package ctech-orders-component was found to contain malicious code...

MAL-2025-17811 Malicious code in ctech-orders-component (npm)

The package ctech-orders-component was found to contain malicious code...

MAL-2025-23070 Malicious code in imd-cloud-orders (npm)

The package imd-cloud-orders was found to contain malicious code...

CVE-2025-5391

The WooCommerce Purchase Orders plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletefile function in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above...

CVE-2025-5391

The WooCommerce Purchase Orders plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletefile function in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above...

CVE-2025-5391 WooCommerce Purchase Orders <= 1.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion

The WooCommerce Purchase Orders plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletefile function in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above...

CVE-2025-5391 WooCommerce Purchase Orders <= 1.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion

The WooCommerce Purchase Orders plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletefile function in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above...

CVE-2025-5391

CVE-2025-5391 affects the WooCommerce Purchase Orders plugin for WordPress (versions ≤ 1.0.2). The vulnerability arises from insufficient file path validation in the delete_file() function, allowing authenticated attackers with Subscriber-level access or higher to delete arbitrary files on the se...

PT-2025-32616 · WordPress · Woocommerce Purchase Orders

Name of the Vulnerable Software and Affected Versions: WooCommerce Purchase Orders plugin for WordPress versions up to and including 1.0.2 Description: The WooCommerce Purchase Orders plugin for WordPress is susceptible to arbitrary file deletion due to inadequate file path validation within the...

WordPress plugin WooCommerce Purchase Orders 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. The WordPress WooCommerce Purchase Orders plugin suffers from an arbitrary file deletion vulnerability that stems from the program failing to properly filter for special element...