WordPress Better Messages – WC Vendors Integration Plugin < 1.0.9 is vulnerable to Cross Site Scripting (XSS)

Software Better Messages – WC Vendors Integration Type Plugin Vulnerable versions 1.0.9 Fixed in 1.0.9 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 1b4af850e1d8 Credits Rafie...

WordPress WC Place Order Without Payment Plugin < 2.5.2 is vulnerable to Cross Site Scripting (XSS)

Software WC Place Order Without Payment Type Plugin Vulnerable versions 2.5.2 Fixed in 2.5.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 20778007dca1 Credits Rafie Muhammad...

WordPress BP WC Vendors Plugin <= 1.1.6 is vulnerable to Cross Site Scripting (XSS)

Software BP WC Vendors Type Plugin Vulnerable versions = 1.1.6 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 5c34163fa809 Credits Rafie Muhammad Patchstack Required...

WordPress WC REST Payment Plugin <= 1.4.1 is vulnerable to Cross Site Scripting (XSS)

Software WC REST Payment Type Plugin Vulnerable versions = 1.4.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 3803bd96e128 Credits Rafie Muhammad Patchstack Required...

CVE-2023-0277

The WC Fields Factory WordPress plugin through 4.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...

Sql injection

The WC Fields Factory WordPress plugin through 4.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...

CVE-2023-0277

The CVE CVE-2023-0277 affects WC Fields Factory for WordPress (

CVE-2023-0277 WC Fields Factory <= 4.1.5 - ShopManager+ SQLi

The WC Fields Factory WordPress plugin through 4.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...

WordPress Plugin WC Fields Factory SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A SQL injection vulnerability exists in...

PT-2023-16135

Name of the Vulnerable Software and Affected Versions WC Fields Factory WordPress plugin versions 4.1.5 and earlier Description The issue arises from the plugin's failure to properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection. This can be...

CVE-2023-0277: Undefined Security Weakness

The WC Fields Factory WordPress plugin through 4.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...

WordPress WC Fields Factory Plugin <= 4.1.6 is vulnerable to SQL Injection

Software WC Fields Factory Type Plugin Vulnerable versions = 4.1.6 Fixed in 4.1.7 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-0277 Patch priority High CVSS severity High 7.6 Developer Claim ownership PSID 9041a40cc32e Credits Daniel Krohmer Fraunhofer IESE Kunal Sharma...

WordPress WC Fields Factory Plugin <= 4.1.5 is vulnerable to SQL Injection

Software WC Fields Factory Type Plugin Vulnerable versions = 4.1.5 Fixed in 4.1.6 OWASP Top 10 A1: Injection Classification SQL Injection CVE N/A Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID c99b371115f2 Credits Unknown Required privilege Subscriber Published 29 March...

Cross site request forgery (csrf)

The WC Sales Notification WordPress plugin before 1.2.3 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack...

CVE-2023-1087

The CVE-2023-1087 entry concerns the WC Sales Notification WordPress plugin, affected versions prior to 1.2.3. The vulnerability is a CSRF issue in the plugin activation flow, allowing a logged-in attacker to trigger activation of arbitrary plugins on the target blog without proper CSRF checks. T...

CVE-2023-1087 WC Sales Notification < 1.2.3 - Arbitrary Plugin Activation via CSRF

The WC Sales Notification WordPress plugin before 1.2.3 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack...

WordPress plugin WC Sales Notification 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

WC Fields Factory < 4.1.7 - ShopManager+ SQLi

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...

CVE-2023-1087: Undefined Security Weakness

The WC Sales Notification WordPress plugin before 1.2.3 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack...

WordPress WC Sales Notification Plugin < 1.2.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software WC Sales Notification Type Plugin Vulnerable versions 1.2.3 Fixed in 1.2.3 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-1087 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 359b32e62cb7 Credits WPScan Required...