CVE-2022-2099

CVE-2022-2099 affects the WooCommerce WordPress plugin prior to 6.6.0. The issue is a stored HTML injection vulnerability caused by insufficient escaping/sanitizing in the payment gateway titles, enabling injection into stored content. Impact is limited to sites running WooCommerce versions befor...

CVE-2022-2099 WooCommerce < 6.6.0 - Admin+ Stored HTML Injection

The WooCommerce WordPress plugin before 6.6.0 is vulnerable to stored HTML injection due to lack of escaping and sanitizing in the payment gateway titles...

PT-2022-14857 · WordPress · Woocommerce

Name of the Vulnerable Software and Affected Versions: WooCommerce WordPress plugin versions prior to 6.6.0 Description: The issue is related to stored HTML injection due to a lack of escaping and sanitizing in the payment gateway titles. This allows for potential malicious code injection...

WordPress plugin WooCommerce 代码注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code injection...

CVE-2022-2099: Improper Encoding or Escaping of Output

The WooCommerce WordPress plugin before 6.6.0 is vulnerable to stored HTML injection due to lack of escaping and sanitizing in the payment gateway titles...

Zibal 安全漏洞

Zibal is the Zibal payment gateway. A security vulnerability exists in Zibal. An attacker could exploit the vulnerability to access sensitive user information and digital currency keys, as well as elevated privileges...

WooCommerce < 6.6.0 - Admin+ Stored HTML Injection

The plugin is vulnerable to stored HTML injection due to lack of escaping and sanitizing in the payment gateway titles PoC Go to WooCommerce - Settings - Payments tab, enable BAC Bank Account Transfers and edit the title in the setup dialog. HTML can be injected there, and will be rendered both f...

Design/Logic Flaw

silverstripe-omnipay is a SilverStripe integration with Omnipay PHP payments library. For a subset of Omnipay gateways those that use intermediary states like isNotification or isRedirect, if the payment identifier or success URL is exposed it is possible for payments to be prematurely marked as...

GHSA-48F2-M7JG-866X Failed payment recorded has completed in Silverstripe Omnipay

Impact For a subset of Omnipay gateways those that use intermediary states like isNotification or isRedirect, if the payment identifier or success URL is exposed it is possible for payments to be prematurely marked as completed without payment being taken. This is mitigated by the fact that most...

CVE-2022-29254

The CVE-2022-29254 issue affects silverstripe-omnipay (SilverStripe integration with Omnipay). For certain gateways using intermediary states (isNotification/isRedirect), exposing the payment identifier or success URL can cause payments to be prematurely marked as completed without payment actual...

subrion CMS Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability in subrion CMS Version = 4.2.1 allows remote attackers to execute arbitrary web script via the "payment gateway" column on transactions tab...

GHSA-XHC3-5PGF-P576 subrion CMS Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability in subrion CMS Version = 4.2.1 allows remote attackers to execute arbitrary web script via the "payment gateway" column on transactions tab...

WooCommerce < 6.3.1 - Orders Marked as Paid (via PayPal Standard Gateway)

The PayPal Standard payment gateway deprecated since July 2021 of the plugin could allow attackers to mark an order as paid without actually making a payment, when PDT is enabled...

WordPress Payment Gateway Groups for WooCommerce plugin <= 1.1.2 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Payment Gateway Groups for WooCommerce plugin versions = 1.1.2. Solution Update the WordPress Payment Gateway Groups for WooCommerce plugin to the latest available version at least 1.1.3...

WordPress Choice Payment Gateway for WooCommerce plugin <= 2.0.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Choice Payment Gateway for WooCommerce plugin versions = 2.0.1. Solution Update the WordPress Choice Payment Gateway for WooCommerce plugin to the latest available version at least 2.0.2...

WordPress Dreamfox Media Payment gateway per Product for Woocommerce plugin < 3.1.6 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Dreamfox Media Payment gateway per Product for Woocommerce plugin versions 3.1.6. Solution Update the WordPress Dreamfox Media Payment gateway per Product for Woocommerce plugin to the latest available version at least 3.1.6...

WordPress RecurWP – WordPress Recurly Payment Gateway plugin <= 1.0.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress RecurWP – WordPress Recurly Payment Gateway plugin versions = 1.0.1. Solution No patched version available...

WordPress Dreamfox Media Payment gateway per Product for Woocommerce plugin < 3.1.6 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Dreamfox Media Payment gateway per Product for Woocommerce plugin versions 3.1.6. Solution Update the WordPress Dreamfox Media Payment gateway per Product for Woocommerce plugin to the latest available version at least 3.1.6...

WordPress Payment Gateway Groups for WooCommerce plugin <= 1.1.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Payment Gateway Groups for WooCommerce plugin versions = 1.1.2. Solution Update the WordPress Payment Gateway Groups for WooCommerce plugin to the latest available version at least 1.1.3...

WordPress Payment Gateway for PayFabric plugin <= 1.0.5 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Payment Gateway for PayFabric plugin versions = 1.0.5. Solution Update the WordPress Payment Gateway for PayFabric plugin to the latest available version at least 1.0.12...