CVE-2025-6025

CVE-2025-6025 concerns the Order Tip for WooCommerce plugin (WordPress) with unauthenticated input validation failure on the data-tip attribute, affecting all versions up to 1.5.4. The issue enables callers to submit tip values (including negative amounts) that can yield unauthorized discounts, p...

PT-2025-33427 · WordPress · Order Tip For Woocommerce

Name of the Vulnerable Software and Affected Versions: Order Tip for WooCommerce versions up to and including 1.5.4 Description: The Order Tip for WooCommerce plugin for WordPress is susceptible to improper input validation. The lack of server-side validation on the data-tip attribute allows...

WordPress WooCommerce Purchase Orders plugin Arbitrary File Deletion Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. The WordPress WooCommerce Purchase Orders plugin suffers from an arbitrary file deletion vulnerability that stems from the program failing to properly filter for special element...

Malicious code in ctech-orders-component (npm)

The package ctech-orders-component was found to contain malicious code...

Malicious code in imd-cloud-orders (npm)

The package imd-cloud-orders was found to contain malicious code...

MAL-2025-22024 Malicious code in gt.module.shipping-orders (npm)

The package gt.module.shipping-orders was found to contain malicious code...

Malicious code in sls-wallet-orders (npm)

The package sls-wallet-orders was found to contain malicious code...

Malicious code in gt.module.shipping-orders (npm)

The package gt.module.shipping-orders was found to contain malicious code...

MAL-2025-33433 Malicious code in sls-wallet-orders (npm)

The package sls-wallet-orders was found to contain malicious code...

MAL-2025-17811 Malicious code in ctech-orders-component (npm)

The package ctech-orders-component was found to contain malicious code...

MAL-2025-23070 Malicious code in imd-cloud-orders (npm)

The package imd-cloud-orders was found to contain malicious code...

CVE-2025-5391

The WooCommerce Purchase Orders plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletefile function in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above...

CVE-2025-5391

The WooCommerce Purchase Orders plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletefile function in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above...

CVE-2025-5391 WooCommerce Purchase Orders <= 1.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion

The WooCommerce Purchase Orders plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletefile function in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above...

CVE-2025-5391 WooCommerce Purchase Orders <= 1.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion

The WooCommerce Purchase Orders plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletefile function in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above...

CVE-2025-5391

CVE-2025-5391 affects the WooCommerce Purchase Orders plugin for WordPress (versions ≤ 1.0.2). The vulnerability arises from insufficient file path validation in the delete_file() function, allowing authenticated attackers with Subscriber-level access or higher to delete arbitrary files on the se...

PT-2025-32616 · WordPress · Woocommerce Purchase Orders

Name of the Vulnerable Software and Affected Versions: WooCommerce Purchase Orders plugin for WordPress versions up to and including 1.0.2 Description: The WooCommerce Purchase Orders plugin for WordPress is susceptible to arbitrary file deletion due to inadequate file path validation within the...

WordPress plugin WooCommerce Purchase Orders 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. The WordPress WooCommerce Purchase Orders plugin suffers from an arbitrary file deletion vulnerability that stems from the program failing to properly filter for special element...

WordPress WooCommerce Purchase Orders plugin <= 1.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion vulnerability

Authenticated Subscriber+ Arbitrary File Deletion vulnerability discovered by CVEhunter in WordPress Plugin WooCommerce Purchase Orders versions = 1.0.2...

CVE-2025-5816

The Plugin Pengiriman WooCommerce Kurir Reguler, Instan, Kargo – Biteship plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.2.0 via the getorderdetail due to missing validation on a user controlled key. This makes it possible for...