WooCommerce Stripe Payment Gateway Plugin for WordPress < 7.4.1 Insecure Direct Object Reference

The WordPress WooCommerce Stripe Payment Gateway Plugin installed on the remote host is affected by an Insecure Direct Object Reference leading to Personally Identifiable Information Disclosure. Note that the scanner has not tested for these issues but has instead relied only on the application's...

WooCommerce Stripe Payment Gateway < 7.4.1 - Subscriber+ Order Intent Update

The plugin does not properly restrict users from making a certain set of changes to other customers' orders. TODO: ADD link to Patchstack's post instead of H1 PoC Affected functions: createpaymentintentajax updatepaymentintentajax saveupeappearanceajax updateorderstatusajax updatefailedorderajax ...

WooCommerce Stripe Payment Gateway < 7.4.1 - Subscriber+ Order Intent Update

The plugin does not properly restrict users from making a certain set of changes to other customers' orders. TODO: ADD link to Patchstack's post instead of H1 Affected functions: createpaymentintentajax updatepaymentintentajax saveupeappearanceajax updateorderstatusajax updatefailedorderajax As a...

CVE-2023-34000

CVE-2023-34000 affects WordPress WooCommerce Stripe Payment Gateway plugin versions up to 7.4.0, with a fix in 7.4.1. The vulnerability is an unauthenticated insecure direct object reference (IDOR) that allows viewing order PII (email, name, full address) due to inadequate access control in order...

CVE-2023-34000 WordPress WooCommerce Stripe Payment Gateway Plugin <= 7.4.0 is vulnerable to Insecure Direct Object References (IDOR)

Unauth. IDOR vulnerability leading to PII Disclosure in WooCommerce Stripe Payment Gateway plugin = 7.4.0 versions...

CVE-2023-34000 WordPress WooCommerce Stripe Payment Gateway Plugin <= 7.4.0 is vulnerable to Insecure Direct Object References (IDOR)

Unauth. IDOR vulnerability leading to PII Disclosure in WooCommerce Stripe Payment Gateway plugin = 7.4.0 versions...

WordPress Plugin WooCommerce Stripe Payment Gateway 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

WooCommerce Stripe Payment Gateway < 7.4.1 - Unauthenticated PII Disclosure via IDOR

The plugin does not ensure that the order details to be displayed belongs to the user making the request, allows unauthenticated users to access sensitive information about the reorder details such as first/last names, email and address As unauthenticated, see the source of...

WordPress WooCommerce Stripe Payment Gateway Plugin <= 7.4.0 is vulnerable to Insecure Direct Object References (IDOR)

Software WooCommerce Stripe Payment Gateway Type Plugin Vulnerable versions = 7.4.0 Fixed in 7.4.1 OWASP Top 10 A5: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2023-34000 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID 38958ed35e7d...

WordPress WooCommerce Stripe Payment Gateway Plugin <= 7.4.0 is vulnerable to Broken Access Control

Software WooCommerce Stripe Payment Gateway Type Plugin Vulnerable versions = 7.4.0 Fixed in 7.4.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-35049 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID e9d7b3efee69 Credits Rafie...

CVE-2022-4118

The Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop WordPress plugin through 1.7.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by authenticated users...

CVE-2022-4118

CVE-2022-4118 affects the Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor (WordPress) up to version 1.7.1. The vulnerability is a SQL injection in a parameter used in a SQL statement due to improper sanitization/escaping. This can be exploited by authenticated users. Affected soft...

CVE-2022-4118 Bitcoin / AltCoin Payment Gateway <= 1.7.1 - Unauthenticated SQLi

The Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop WordPress plugin through 1.7.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by authenticated users...

WordPress plugin Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports PHP and MySQL servers to set up a personal blog site. WordPress plugin is an application plugin. WordPress plugin Bitcoin / AltCoin...

WordPress Robokassa payment gateway for Woocommerce Plugin <= 1.4.5 is vulnerable to Cross Site Scripting (XSS)

Software Robokassa payment gateway for Woocommerce Type Plugin Vulnerable versions = 1.4.5 Fixed in 1.4.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Low CVSS severity Low 4.4 Developer Claim ownership PSID fad0fc2813b1 Credits N/A...

Japanized For WooCommerce < 2.5.8 - Reflected XSS

The plugin does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting With the PeachPay payment gateway enabled can be enabled via the settings: http://example.com/wp-admin/admin.php?page=wc4jp-options&tab=payment Make a logged in admin open the...

Bitcoin / AltCoin Payment Gateway <= 1.7.1 - Unauthenticated SQLi

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by authenticated users PoC Setup: 1. Install woocommerce dependency, no setup required 2. Install the vulnerable plugin woo-altcoin-payment-gateway version 1.7.1...

WordPress Paytm Payment Gateway Plugin <= 2.7.3 is vulnerable to SQL Injection

Software Paytm Payment Gateway Type Plugin Vulnerable versions = 2.7.3 Fixed in 2.7.7 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2022-45805 Patch priority Low CVSS severity Low 8.2 Developer Claim ownership PSID a951aa23af06 Credits Aman Rawat Required privilege Editor...

WordPress plugin WooCommerce code injection vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code injection...

GHSA-JWVF-28FG-G4XG WooCommerce WordPress plugin before 6.6.0 vulnerable to stored HTML injection

The WooCommerce WordPress plugin before 6.6.0 is vulnerable to stored HTML injection due to lack of escaping and sanitizing in the payment gateway titles...