WordPress BP WC Vendors plugin <= 1.1.6 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress BP WC Vendors plugin versions = 1.1.6. Solution No patched version available...

WordPress Advanced WC Analytics – Google Analytics Dashboard for WooCommerce plugin < 3.0.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Advanced WC Analytics – Google Analytics Dashboard for WooCommerce plugin versions 3.0.0. Solution Update the WordPress Advanced WC Analytics – Google Analytics Dashboard for WooCommerce plugin to the...

WordPress Better Messages – WC Vendors Integration plugin <= 1.0.6 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Better Messages – WC Vendors Integration plugin versions = 1.0.6. Solution Update the WordPress Better Messages – WC Vendors Integration plugin to the latest available version at least 1.0.7...

WordPress WC Place Order Without Payment plugin <= 2.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress WC Place Order Without Payment plugin versions = 2.1. Solution Update the WordPress WC Place Order Without Payment plugin to the latest available version at least 2.2...

WordPress WC Place Order Without Payment plugin <= 2.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress WC Place Order Without Payment plugin versions = 2.1. Solution Update the WordPress WC Place Order Without Payment plugin to the latest available version at least 2.2...

WordPress WC REST Payment plugin <= 1.4.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress WC REST Payment plugin versions = 1.4.1. Solution No patched version available...

WordPress WC Marketplace plugin <= 3.8.4 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by WPScanTeam in WordPress WC Marketplace plugin versions = 3.8.4. Solution Update the WordPress WC Marketplace plugin to the latest available version at least 3.8.5...

PT-2021-22553

Name of the Vulnerable Software and Affected Versions: Stripe for WooCommerce WordPress plugin versions 3.0.0 through 3.3.9 Description: The issue is related to a missing capability check on the save function found in the /includes/admin/class-wc-stripe-admin-user-edit.php file. This allows...

CVE-2021-39347: Missing Authorization

The Stripe for WooCommerce WordPress plugin is missing a capability check on the save function found in the /includes/admin/class-wc-stripe-admin-user-edit.php file that makes it possible for attackers to configure their account to use other site users unique STRIPE identifier and make purchases...

OESA-2021-1346 grilo security update

Grilo is a framework focused on making media discovery and browsing easy for application developers. Security Fixes: In GNOME grilo though 0.3.13, grl-net-wc.c does not enable TLS certificate verification on the SoupSessionAsync objects it creates, leaving users vulnerable to network MITM attacks...

CVE-2021-32789

woocommerce-gutenberg-products-block is a feature plugin for WooCommerce Gutenberg Blocks. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce Blocks feature plugin between version 2.5.0 and prior to version 2.5.16. Via a carefully crafted URL, an exploit can be...

PT-2021-19934

Name of the Vulnerable Software and Affected Versions WooCommerce versions 3.3.0 through 3.3.5 Description An SQL injection issue affects WooCommerce sites running the plugin between versions 3.3.0 and 3.3.5. Malicious actors with admin access or API keys can exploit vulnerable endpoints such as...

PT-2021-19932

Name of the Vulnerable Software and Affected Versions woocommerce-gutenberg-products-block versions 2.5.0 through 2.5.15 Description An SQL injection issue affects WooCommerce sites running the WooCommerce Blocks feature plugin. This can be exploited via a carefully crafted URL against the...

CVE-2021-32789: Improper Neutralization of Special Elements used in an SQL Command

woocommerce-gutenberg-products-block is a feature plugin for WooCommerce Gutenberg Blocks. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce Blocks feature plugin between version 2.5.0 and prior to version 2.5.16. Via a carefully crafted URL, an exploit can be...

WordPress WC Marketplace plugin <= 3.7.3 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability discovered by NinTechNet in WordPress WC Marketplace plugin versions = 3.7.3. Solution Update the WordPress WC Marketplace plugin to the latest available version at least 3.7.4...

WordPress WC Marketplace plugin <= 3.7.3 - Unauthenticated Arbitrary Product Comment Posting vulnerability

Unauthenticated Arbitrary Product Comment Posting vulnerability discovered by WPScanTeam in WordPress WC Marketplace plugin versions = 3.7.3. Solution Update the WordPress WC Marketplace plugin to the latest available version at least 3.7.4...

Command injection in wc-cmd

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

GHSA-MX3R-W3PJ-7WV7 Command injection in wc-cmd

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

Command Injection

wc-cmd is vulnerable to command injection. An attacker is able to inject and execute malicious command via the index.js file...

PT-2021-11530

Name of the Vulnerable Software and Affected Versions: wc-cmd versions all Description: The issue concerns command injection via the index.js file in the wc-cmd package. An example of exploitation is provided using the require function to execute a command, such as touch JHU. Recommendations: For...