WordPress plugin Woo Products Widgets For Elementor 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2015-10095

A vulnerability classified as problematic has been found in woo-popup Plugin up to 1.2.2 on WordPress. This affects an unknown part of the file admin/class-woo-popup-admin.php. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.3...

Cross site scripting

A vulnerability classified as problematic has been found in woo-popup Plugin up to 1.2.2 on WordPress. This affects an unknown part of the file admin/class-woo-popup-admin.php. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.3...

CVE-2015-10095

The CVE-2015-10095 entry applies to the woo-popup WordPress plugin (versions up to 1.2.2) and involves an unknown part of the file admin/class-woo-popup-admin.php. The vulnerability enables cross-site scripting (XSS) and can be exploited remotely. The fixed version is 1.3.0, with the patch identi...

WordPress plugin woo-popup 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Ecwid Shopping Cart < 6.11.4 - Import via CSRF

The plugin does not have CSRF check when importing Woo data, which could allow attackers to make logged in admins perform such action via a CSRF attack...

WordPress plugin Woo Billingo Plus 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Woo Billingo Plus version 4.4.5.4 or earlier, Integration for Billingo & Gravity Forms...

CVE-2022-3154

CVE-2022-3154 affects multiple WordPress plugins related to Billingo integration: Woo Billingo Plus (pre-4.4.5.4), Integration for Billingo & Gravity Forms (pre-1.0.4), and Integration for Szamlazz.hu & Gravity Forms (pre-1.2.7). The root cause is lack of CSRF checks in various AJAX actions, enab...

WordPress Woo Billingo Plus plugin <= 4.4.5.3 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities

Multiple Cross-Site Request Forgery CSRF vulnerabilities were discovered by Lana Codes in the WordPress Woo Billingo Plus plugin versions = 4.4.5.3. Solution Update the WordPress Woo Billingo Plus plugin to the latest available version at least 4.4.5.4...

Woo Discount Rules < 2.4.2 - Reflected Cross-Site Scripting

The plugin does not escape a parameter before outputting it back in an attribute of the plugin's discount rule page, leading to Reflected Cross-Site Scripting PoC https://example.com/wp-admin/admin.php?page=woodiscountrules="+style=animation-name:rotation+onanimationstart=alert/XSS///...

Woo Discount Rules < 2.4.2 - Reflected Cross-Site Scripting

The plugin does not escape a parameter before outputting it back in an attribute of the plugin's discount rule page, leading to Reflected Cross-Site Scripting https://example.com/wp-admin/admin.php?page=woodiscountrules&name="+style=animation-name:rotation+onanimationstart=alert/XSS///...

Malicious code in woo-cart-expiration (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 24cfe9d8fcf65de1f13300aad8d4f80a7799b08acca23005f742a7addac882ab Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in lw-woo-gdpr-user-optins (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 105df6f835a4083e23ae8a715939002d9787e3a1f8290dcf1093dc9ae8039a9a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4427 Malicious code in lw-woo-gdpr-user-optins (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 105df6f835a4083e23ae8a715939002d9787e3a1f8290dcf1093dc9ae8039a9a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in woo-better-reviews (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 01c5fc72d3e1dfcc1d25abff23760de62aa6b51a12bd936f3e8b2ffefcc3dfa5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7213 Malicious code in woo-cart-expiration (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 24cfe9d8fcf65de1f13300aad8d4f80a7799b08acca23005f742a7addac882ab Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7212 Malicious code in woo-better-reviews (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 01c5fc72d3e1dfcc1d25abff23760de62aa6b51a12bd936f3e8b2ffefcc3dfa5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in woo-interest-in-products (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6c02a1fed016c6ea57e23f22d9ce66fd6e951fbc137f586bc556c53cc8d97a0a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7214 Malicious code in woo-interest-in-products (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6c02a1fed016c6ea57e23f22d9ce66fd6e951fbc137f586bc556c53cc8d97a0a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress WPify Woo Czech plugin <= 3.5.6 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by WPScanTeam in WordPress WPify Woo Czech plugin versions = 3.5.6. Solution Update the WordPress WPify Woo Czech plugin to the latest available version at least 3.5.7...