WordPress WC Marketplace Plugin <= 3.8.11.8 - Unauthorized AJAX Calls Vulnerability

Unauthorized AJAX Calls vulnerability discovered by ptsfence in WordPress WC Marketplace plugin versions = 3.8.11.8. Solution Update the WordPress WC Marketplace plugin to the latest available version at least 3.8.12...

WordPress WC Marketplace Plugin <= 3.8.11.8 - Reflected Cross-Site Scripting vulnerability

Multiple Reflected Cross-Site Scripting vulnerabilities discovered by WPScan in WordPress WC Marketplace plugin versions = 3.8.11.8. Solution Update the WordPress WC Marketplace plugin to the latest available version at least 3.18.2...

CURCY < 2.1.18 - Reflected Cross-Site Scripting

The plugin does not escape some generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting https://example.com/wp-admin/admin.php?page=wc-reports&a"alert/XSS/...

WordPress BP WC Vendors plugin <= 1.1.6 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress BP WC Vendors plugin versions = 1.1.6. Solution No patched version available...

WordPress BP WC Vendors plugin <= 1.1.6 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress BP WC Vendors plugin versions = 1.1.6. Solution No patched version available...

WordPress Advanced WC Analytics – Google Analytics Dashboard for WooCommerce plugin < 3.0.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Advanced WC Analytics – Google Analytics Dashboard for WooCommerce plugin versions 3.0.0. Solution Update the WordPress Advanced WC Analytics – Google Analytics Dashboard for WooCommerce plugin to the...

WordPress Better Messages – WC Vendors Integration plugin <= 1.0.6 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Better Messages – WC Vendors Integration plugin versions = 1.0.6. Solution Update the WordPress Better Messages – WC Vendors Integration plugin to the latest available version at least 1.0.7...

WordPress WC REST Payment plugin <= 1.4.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress WC REST Payment plugin versions = 1.4.1. Solution No patched version available...

WordPress WC Place Order Without Payment plugin <= 2.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress WC Place Order Without Payment plugin versions = 2.1. Solution Update the WordPress WC Place Order Without Payment plugin to the latest available version at least 2.2...

WordPress WC Place Order Without Payment plugin <= 2.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress WC Place Order Without Payment plugin versions = 2.1. Solution Update the WordPress WC Place Order Without Payment plugin to the latest available version at least 2.2...

WordPress WC REST Payment plugin <= 1.4.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress WC REST Payment plugin versions = 1.4.1. Solution No patched version available...

WordPress Better Messages – WC Vendors Integration plugin <= 1.0.6 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Better Messages – WC Vendors Integration plugin versions = 1.0.6. Solution Update the WordPress Better Messages – WC Vendors Integration plugin to the latest available version at least 1.0.7...

WordPress WC Marketplace plugin <= 3.8.4 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by WPScanTeam in WordPress WC Marketplace plugin versions = 3.8.4. Solution Update the WordPress WC Marketplace plugin to the latest available version at least 3.8.5...

OESA-2021-1346 grilo security update

Grilo is a framework focused on making media discovery and browsing easy for application developers. Security Fixes: In GNOME grilo though 0.3.13, grl-net-wc.c does not enable TLS certificate verification on the SoupSessionAsync objects it creates, leaving users vulnerable to network MITM attacks...

WordPress WC Marketplace plugin <= 3.7.3 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability discovered by NinTechNet in WordPress WC Marketplace plugin versions = 3.7.3. Solution Update the WordPress WC Marketplace plugin to the latest available version at least 3.7.4...

WordPress WC Marketplace plugin <= 3.7.3 - Unauthenticated Arbitrary Product Comment Posting vulnerability

Unauthenticated Arbitrary Product Comment Posting vulnerability discovered by WPScanTeam in WordPress WC Marketplace plugin versions = 3.7.3. Solution Update the WordPress WC Marketplace plugin to the latest available version at least 3.7.4...

GHSA-MX3R-W3PJ-7WV7 Command injection in wc-cmd

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

Command injection in wc-cmd

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

Command Injection

wc-cmd is vulnerable to command injection. An attacker is able to inject and execute malicious command via the index.js file...

Command Injection

Amendment This was deemed not a vulnerability. Overview Affected versions of this package are vulnerable to Command Injection via the index.js file. PoC: var a =require"wc-cmd"; a"touch JHU" Note: CVE-2020-28431 has been retracted because it was found to be invalid. Remediation There is no fixed...