WordPress WooCommerce CVR Payment Gateway Plugin < 6.1.0 is vulnerable to Broken Access Control

Software WooCommerce CVR Payment Gateway Type Plugin Vulnerable versions 6.1.0 Fixed in 6.1.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-4948 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID d4365149d5e3 Credits Lana Codes Yan&C...

CVE-2023-4948: Missing Authorization

The WooCommerce CVR Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the refreshordercvrdata AJAX action in versions up to 6.1.0. This makes it possible for authenticated attackers with contributor-level access and above,...

WordPress WooCommerce EAN Payment Gateway Plugin < 6.1.0 is vulnerable to Broken Access Control

Software WooCommerce EAN Payment Gateway Type Plugin Vulnerable versions 6.1.0 Fixed in 6.1.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-4947 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 9bfa8f9c4e66 Credits Lana Codes Yan&C...

WordPress Plugin WooCommerce CVR Payment Gateway Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in...

WakaTime: Waketime Payment Gateway Vulnerability

Vulnerability description not provided...

WordPress Stripe Payment Gateway for WooCommerce Plugin <= 3.7.7 is vulnerable to Privilege Escalation

Software Stripe Payment Gateway for WooCommerce Type Plugin Vulnerable versions = 3.7.7 Fixed in 3.7.8 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2023-3162 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID...

WordPress Choice Payment Gateway for WooCommerce Plugin <= 2.1.2 is vulnerable to Cross Site Scripting (XSS)

Software Choice Payment Gateway for WooCommerce Type Plugin Vulnerable versions = 2.1.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID fa9893c69c54 Credits Rafie...

WordPress Ether and ERC20 tokens WooCommerce Payment Gateway Plugin < 4.12.13 is vulnerable to Cross Site Scripting (XSS)

Software Ether and ERC20 tokens WooCommerce Payment Gateway Type Plugin Vulnerable versions 4.12.13 Fixed in 4.12.13 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 9ea50f0867f0...

WordPress Payment Gateway Groups for WooCommerce Plugin <= 1.1.3 is vulnerable to Cross Site Scripting (XSS)

Software Payment Gateway Groups for WooCommerce Type Plugin Vulnerable versions = 1.1.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID b23d24f13593 Credits Rafie...

WordPress Authorize.Net Payment Gateway For WooCommerce Plugin < 6.0.4 is vulnerable to Cross Site Scripting (XSS)

Software Authorize.Net Payment Gateway For WooCommerce Type Plugin Vulnerable versions 6.0.4 Fixed in 6.0.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID d6e190843d57 Credits Rafi...

WordPress RecurWP – WordPress Recurly Payment Gateway Plugin <= 1.0.3 is vulnerable to Cross Site Scripting (XSS)

Software RecurWP – WordPress Recurly Payment Gateway Type Plugin Vulnerable versions = 1.0.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 4a644c62a9fc Credits Rafie...

WordPress Payment Gateway for PayFabric Plugin <= 1.0.12.2 is vulnerable to Cross Site Scripting (XSS)

Software Payment Gateway for PayFabric Type Plugin Vulnerable versions = 1.0.12.2 Fixed in 1.0.13 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 40f2aa177659 Credits Rafie Muhammad...

WordPress Dreamfox Media Payment gateway per Product for Woocommerce Plugin < 3.2.7 is vulnerable to Cross Site Scripting (XSS)

Software Dreamfox Media Payment gateway per Product for Woocommerce Type Plugin Vulnerable versions 3.2.7 Fixed in 3.2.7 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID f228b3d2c1e8...

WooCommerce Stripe Payment Gateway Plugin for WordPress < 7.4.1 Insecure Direct Object Reference

The WordPress WooCommerce Stripe Payment Gateway Plugin installed on the remote host is affected by an Insecure Direct Object Reference leading to Personally Identifiable Information Disclosure. Note that the scanner has not tested for these issues but has instead relied only on the application's...

WooCommerce Stripe Payment Gateway < 7.4.1 - Subscriber+ Order Intent Update

The plugin does not properly restrict users from making a certain set of changes to other customers' orders. TODO: ADD link to Patchstack's post instead of H1 PoC Affected functions: createpaymentintentajax updatepaymentintentajax saveupeappearanceajax updateorderstatusajax updatefailedorderajax ...

WooCommerce Stripe Payment Gateway < 7.4.1 - Subscriber+ Order Intent Update

The plugin does not properly restrict users from making a certain set of changes to other customers' orders. TODO: ADD link to Patchstack's post instead of H1 Affected functions: createpaymentintentajax updatepaymentintentajax saveupeappearanceajax updateorderstatusajax updatefailedorderajax As a...

CVE-2023-34000

CVE-2023-34000 affects WordPress WooCommerce Stripe Payment Gateway plugin versions up to 7.4.0, with a fix in 7.4.1. The vulnerability is an unauthenticated insecure direct object reference (IDOR) that allows viewing order PII (email, name, full address) due to inadequate access control in order...

CVE-2023-34000 WordPress WooCommerce Stripe Payment Gateway Plugin <= 7.4.0 is vulnerable to Insecure Direct Object References (IDOR)

Unauth. IDOR vulnerability leading to PII Disclosure in WooCommerce Stripe Payment Gateway plugin = 7.4.0 versions...

CVE-2023-34000 WordPress WooCommerce Stripe Payment Gateway Plugin <= 7.4.0 is vulnerable to Insecure Direct Object References (IDOR)

Unauth. IDOR vulnerability leading to PII Disclosure in WooCommerce Stripe Payment Gateway plugin = 7.4.0 versions...

WordPress Plugin WooCommerce Stripe Payment Gateway 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...