58 matches found
CVE-2024-3934
The Mercado Pago payments for WooCommerce plugin for WordPress is vulnerable to Path Traversal in versions 7.3.0 to 7.5.1 via the mercadopagoDownloadLog function. This makes it possible for authenticated attackers, with subscriber-level access and above, to download and read the contents of...
CVE-2022-45068
Cross-Site Request Forgery CSRF vulnerability in Mercado Pago Mercado Pago payments for WooCommerce plugin = 6.3.1...
CVE-2020-25751
The paGO Commerce plugin 2.5.9.0 for Joomla! allows SQL Injection via the administrator/index.php?option=compago=comments filterpublished parameter...
CVE-2024-12467
The Pago por Redsys plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'DsMerchantParameters' parameter in all versions up to, and including, 1.0.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
CVE-2024-12467
The Pago por Redsys plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'DsMerchantParameters' parameter in all versions up to, and including, 1.0.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
CVE-2024-12467 Pago por Redsys <= 1.0.12 - Reflected Cross-Site Scripting
The Pago por Redsys plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'DsMerchantParameters' parameter in all versions up to, and including, 1.0.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
CVE-2024-12467
CVE-2024-12467: Pago por Redsys WordPress plugin has a reflected XSS in Ds_MerchantParameters affecting all versions up to 1.0.12. Exploitation is unauthenticated; user action (e.g., clicking a link) triggers script execution. The issue is addressed in a subsequent release (1.0.13 per changelog),...
CVE-2024-12467 Pago por Redsys <= 1.0.12 - Reflected Cross-Site Scripting
The Pago por Redsys plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'DsMerchantParameters' parameter in all versions up to, and including, 1.0.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
WordPress plugin Pago por Redsys 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
WordPress Pago por Redsys plugin <= 1.0.12 - Reflected Cross-Site Scripting vulnerability
Reflected Cross-Site Scripting vulnerability discovered by José Aguilera in WordPress Plugin Pago por Redsys versions = 1.0.12...
WordPress Mercado Pago payments for WooCommerce plugin 7.3.0 - 7.6.1 - Authenticated (Subscriber+) Arbitrary File Download vulnerability
WordPress Mercado Pago payments for WooCommerce plugin 7.3.0 - 7.6.1 - Authenticated Subscriber+ Arbitrary File Download vulnerability discovered by Krzysztof Zając in WordPress Plugin Mercado Pago payments for WooCommerce versions 7.3.0 - 7.6.1...
WordPress Mercado Pago payments for WooCommerce Plugin 7.3.0 - 7.6.1 is vulnerable to Arbitrary File Download
Software Mercado Pago payments for WooCommerce Type Plugin Vulnerable versions 7.3.0 - 7.6.1 Fixed in 7.6.2 OWASP Top 10 A3: Sensitive Data Exposure Classification Arbitrary File Download CVE CVE-2024-3934 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID e624a5a01127...
CVE-2024-3934
The Mercado Pago payments for WooCommerce plugin for WordPress is vulnerable to Path Traversal in versions 7.3.0 to 7.5.1 via the mercadopagoDownloadLog function. This makes it possible for authenticated attackers, with subscriber-level access and above, to download and read the contents of...
CVE-2024-3934 Mercado Pago payments for WooCommerce 7.3.0 - 7.6.1 - Authenticated (Subscriber+) Arbitrary File Download
The Mercado Pago payments for WooCommerce plugin for WordPress is vulnerable to Path Traversal in versions 7.3.0 to 7.5.1 via the mercadopagoDownloadLog function. This makes it possible for authenticated attackers, with subscriber-level access and above, to download and read the contents of...
CVE-2024-3934 Mercado Pago payments for WooCommerce 7.3.0 - 7.6.1 - Authenticated (Subscriber+) Arbitrary File Download
The Mercado Pago payments for WooCommerce plugin for WordPress is vulnerable to Path Traversal in versions 7.3.0 to 7.5.1 via the mercadopagoDownloadLog function. This makes it possible for authenticated attackers, with subscriber-level access and above, to download and read the contents of...
CVE-2024-3934
CVE-2024-3934 affects the Mercado Pago payments for WooCommerce plugin for WordPress. A Path Traversal flaw in versions 7.3.0–7.5.1 allows authenticated users with subscriber-level access and above to download and read arbitrary server files via mercadopagoDownloadLog. Wordfence notes the arbitra...
WordPress Mercado Pago payments for WooCommerce Plugin < 6.4.0 CSRF Vulnerability
The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mercadopago:mercadopagopaymentsforwoocommerce"; if descripti...
CVE-2022-45068
Cross-Site Request Forgery CSRF vulnerability in Mercado Pago Mercado Pago payments for WooCommerce plugin = 6.3.1...
