CVE-2024-52444

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in wpopal Opal Woo Custom Product Variation opal-woo-custom-product-variation allows Path Traversal.This issue affects Opal Woo Custom Product Variation: from n/a through = 1.1.3...

CVE-2024-7854

The Woo Inquiry plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 0.1 due to insufficient escaping on the user supplied parameter 'dbid' and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to...

CVE-2024-32724

Missing Authorization vulnerability in Woo product importer Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy.This issue affects Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy: from n/a through 2.1.1...

CVE-2024-33946

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPify s.R.O. WPify Woo Czech allows Reflected XSS.This issue affects WPify Woo Czech: from n/a through 4.0.10...

CVE-2025-23588

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in baonguyenyam WOW Best CSS Compiler best-css-compiler allows Reflected XSS.This issue affects WOW Best CSS Compiler: from n/a through = 2.0.2...

CVE-2024-13100

The CVE-2024-13100 entry concerns the OPSI Israel Domestic Shipments WordPress plugin (versions <= 2.6.3). The issue is a Reflected Cross-Site Scripting (XSS) vulnerability caused by insufficient sanitisation/escaping of a parameter before it is echoed on the page, potentially impacting high-p...

CVE-2024-13100 Woo UPS Pickup <= 2.6.3 - Reflected XSS

The OPSI Israel Domestic Shipments WordPress plugin through 2.6.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13100 Woo UPS Pickup <= 2.6.3 - Reflected XSS

The OPSI Israel Domestic Shipments WordPress plugin through 2.6.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2025-23761

Missing Authorization vulnerability in Alex Volkov Woo Tuner allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Woo Tuner: from n/a through 0.1.2...

CVE-2025-23761 WordPress Woo Tuner plugin <= 0.1.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Alex Volkov Woo Tuner allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Woo Tuner: from n/a through 0.1.2...

CVE-2025-23761

CVE-2025-23761 involves a Missing Authorization vulnerability in the Woo Tuner WordPress plugin (Woo Tuner: from n/a to 0.1.2) that could allow exploiting incorrectly configured access control. Red Hat’s entry reiterates the issue as Missing Authorization affecting Woo Tuner and lists the same pr...

WordPress Woo Update Variations In Cart plugin <= 0.0.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by SOPROBRO in WordPress Plugin Woo Update Variations In Cart versions = 0.0.9...

WordPress Woo Tuner plugin <= 0.1.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mika in WordPress Plugin Woo Tuner versions = 0.1.2...

WordPress Woo Store Mode plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara Kinorth in WordPress Plugin Woo Store Mode versions = 1.0.1...

PT-2025-5072 · Woo Tuner · Woo Tuner

Name of the Vulnerable Software and Affected Versions: Woo Tuner versions 0.1.2 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For Woo Tuner versions 0.1.2 and...

WordPress plugin Woo Tuner 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

CVE-2024-12049 Woo Ukrposhta <= 1.17.11 - Reflected Cross-Site Scripting via order, post, and idd Parameters

The Woo Ukrposhta plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'order', 'post', and 'idd' parameters in all versions up to, and including, 1.17.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2024-12049

CVE-2024-12049 refers to a vulnerability in the WordPress plugin Woo Ukrposhta where a Reflected Cross-Site Scripting (XSS) can be triggered via the order , post , and idd parameters. The issue affects all versions up to and including 1.17.11 and arises from insufficient input sanitization and ou...

WordPress plugin Woo Ukrposhta 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...

PT-2025-1738 · WordPress · Woo Ukrposhta

Name of the Vulnerable Software and Affected Versions: Woo Ukrposhta plugin for WordPress versions up to and including 1.17.11 Description: The Woo Ukrposhta plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the order, post, and idd parameters due to insufficient input...