CVE-2024-55996

CVE-2024-55996 is a missing authorization vulnerability in the Dreamfox Payment Gateway for WooCommerce. The root cause is incorrectly configured access control levels, allowing unauthorized users to exploit product-level permissions. Affected: Dreamfox Payment Gateway for WooCommerce, versions u...

CVE-2024-55996 WordPress Payment gateway per Product for WooCommerce plugin <= 3.5.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in dreamfox Dreamfox Media Payment gateway per Product for Woocommerce woocommerce-product-payments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dreamfox Media Payment gateway per Product for Woocommerce: from n/a...

PT-2024-36650 · Dreamfox Media · Dreamfox Media Payment Gateway Per Product For Woocommerce

Name of the Vulnerable Software and Affected Versions: Dreamfox Media Payment gateway per Product for Woocommerce versions 3.5.6 and earlier Description: The issue is related to a missing authorization vulnerability in the Dreamfox Media Payment gateway per Product for Woocommerce, which allows...

WordPress Payment gateway per Product for WooCommerce plugin <= 3.5.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin Dreamfox Media Payment gateway per Product for Woocommerce versions = 3.5.6...

CVE-2024-11329

The Comfino Payment Gateway plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 4.1.1. This makes it possible for unauthenticated attackers to inject...

CVE-2024-11329 Comfino Payment Gateway <= 4.1.1 - Reflected Cross-Site Scripting

The Comfino Payment Gateway plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 4.1.1. This makes it possible for unauthenticated attackers to inject...

CVE-2024-11329

CVE-2024-11329 affects the WordPress plugin Comfino Payment Gateway up to version 4.1.1. It is a Reflected Cross-Site Scripting vulnerability caused by using add_query_arg and remove_query_arg without proper URL escaping, allowing unauthenticated attackers to inject scripts in pages triggered by ...

CVE-2024-11329 Comfino Payment Gateway <= 4.1.1 - Reflected Cross-Site Scripting

The Comfino Payment Gateway plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 4.1.1. This makes it possible for unauthenticated attackers to inject...

PT-2024-16913 · WordPress · Comfino Payment Gateway

Name of the Vulnerable Software and Affected Versions: Comfino Payment Gateway plugin for WordPress versions up to, and including, 4.1.1 Description: The Comfino Payment Gateway plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add query arg and remove query a...

WordPress Comfino Payment Gateway plugin <= 4.1.1 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin Comfino Payment Gateway versions = 4.1.1...

CVE-2024-53759

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Planet Studio ArCa Payment Gateway arca-payment-gateway allows Stored XSS.This issue affects ArCa Payment Gateway: from n/a through = 1.3.1...

CVE-2024-52460 WordPress AtaraPay WooCommerce Payment Gateway plugin <= 2.0.13 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in AtaraPay AtaraPay WooCommerce Payment Gateway allows Reflected XSS.This issue affects AtaraPay WooCommerce Payment Gateway: from n/a through 2.0.13...

CVE-2024-53759 WordPress ArCa Payment Gateway plugin <= 1.3.1 - CSRF to Stored Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Planet Studio ArCa Payment Gateway arca-payment-gateway allows Stored XSS.This issue affects ArCa Payment Gateway: from n/a through = 1.3.1...

CVE-2024-53759 WordPress ArCa Payment Gateway plugin <= 1.3.1 - CSRF to Stored Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Planet Studio team ArCa Payment Gateway allows Stored XSS.This issue affects ArCa Payment Gateway: from n/a through 1.3.1...

CVE-2024-53759

CVE-2024-53759 refers to a CSRF to Stored Cross‑Site Scripting (XSS) vulnerability in the WordPress plugin “ArCa Payment Gateway” (versions 1.3.1 and earlier). The issue arises from improper input neutralization during web page generation, enabling stored XSS. Affected software is the ArCa Paymen...

PT-2024-35869 · Unknown · Arca Payment Gateway

Name of the Vulnerable Software and Affected Versions: ArCa Payment Gateway versions 1.3.1 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored Cross-site Scripting XSS. This means that an attacker can inject malicio...

WordPress plugin ArCa Payment Gateway 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2024-10665

The Yaad Sarig Payment Gateway For WC plugin for WordPress is vulnerable to unauthorized modification & access of data due to a missing capability check on the yaadpayviewlogcallback and yaadpaydeletelogcallback functions in all versions up to, and including, 2.2.4. This makes it possible for...

CVE-2024-10665 Yaad Sarig Payment Gateway For WC <= 2.2.4 - Missing Authorization to Authenticated (Subscriber+) Log Read/Deletion

The Yaad Sarig Payment Gateway For WC plugin for WordPress is vulnerable to unauthorized modification & access of data due to a missing capability check on the yaadpayviewlogcallback and yaadpaydeletelogcallback functions in all versions up to, and including, 2.2.4. This makes it possible for...

CVE-2024-10665

The CVE-2024-10665 entry concerns the Yaad Sarig Payment Gateway For WC WordPress plugin. The connected documents confirm a root cause: a missing capability check in the yaadpay_view_log_callback() and yaadpay_delete_log_callback() functions, allowing authenticated attackers with Subscriber-level...