CVE-2025-24706 WordPress MultiVendorX plugin <= 4.2.13 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Stored XSS.This issue affects MultiVendorX: from n/a through = 4.2.13...

WordPress plugin WC Marketplace 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Malicious code in wc-skroutz-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 438709bf1de713b9fab756841aa4cba87bbfc22133ff796cb5ee46dcc8776d44 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-259 Malicious code in wc-skroutz-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 438709bf1de713b9fab756841aa4cba87bbfc22133ff796cb5ee46dcc8776d44 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress WC Wallet plugin <= 2.2.0 - Arbitrary Content Deletion vulnerability

Arbitrary Content Deletion vulnerability discovered by Mika in WordPress Plugin WC Wallet versions = 2.2.0...

CVE-2025-22510

Deserialization of Untrusted Data vulnerability in kkarpieszuk WC Price History for Omnibus wc-price-history allows Object Injection.This issue affects WC Price History for Omnibus: from n/a through = 2.1.4...

CVE-2025-22510 WordPress WC Price History for Omnibus plugin <= 2.1.4 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Konrad Karpieszuk WC Price History for Omnibus allows Object Injection.This issue affects WC Price History for Omnibus: from n/a through 2.1.4...

Exploit for CVE-2025-22510

CVE-2025-22510 1️⃣ Component type WordPress plugin 2️...

CVE-2024-12152 MIPL WC Multisite Sync <= 1.1.5 - Unauthenticated Arbitrary File Download

The MIPL WC Multisite Sync plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.5 via the 'miplwcsyncdownloadlog' action. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain...

CVE-2024-12152

CVE-2024-12152 concerns the MIPL WC Multisite Sync WordPress plugin. The Wordfence entry confirms a directory traversal vulnerability that affects all versions up to 1.1.5 via the mipl_wc_sync_download_log action, enabling unauthenticated reading of arbitrary server files containing potentially s...

CVE-2024-12617

The WC Price History for Omnibus plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX actions in all versions up to, and including, 2.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view and...

CVE-2024-12617 WC Price History for Omnibus <= 2.1.3 - Missing Authorization

The WC Price History for Omnibus plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX actions in all versions up to, and including, 2.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view and...

CVE-2024-12617

CVE-2024-12617 affects WC Price History for Omnibus (WordPress). The issue is a missing capability check on several AJAX actions, permitting authenticated users with Subscriber level and above to view and modify history data. This is confirmed by Red Hat/Wordfence references noting the WC Price H...

PT-2024-17675 · WordPress · Wc Price History For Omnibus

Name of the Vulnerable Software and Affected Versions: WC Price History for Omnibus plugin for WordPress versions up to, and including, 2.1.3 Description: The issue is related to unauthorized access due to a missing capability check on several AJAX actions. This allows authenticated attackers wit...

CVE-2023-51355

Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MultiVendorX: from n/a through = 4.0.23...

CVE-2023-51355 WordPress MultiVendorX plugin <= 4.0.23 - Broken Access Control vulnerability

Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MultiVendorX: from n/a through = 4.0.23...

WordPress plugin WC Marketplace 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-14085 · Unknown · Multivendorx Wc Marketplace

Name of the Vulnerable Software and Affected Versions: MultiVendorX WC Marketplace versions n/a through 4.0.23 Description: The issue is related to a Missing Authorization vulnerability in MultiVendorX WC Marketplace, which allows exploiting incorrectly configured access control security levels...

Malicious code in @agilent/awf-wc (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2024-52484

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in deepintowp Wc Recently viewed products wc-recently-viewed-products allows Reflected XSS.This issue affects Wc Recently viewed products: from n/a through = 1.0.1...