Malicious code in woo-cart-expiration (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 24cfe9d8fcf65de1f13300aad8d4f80a7799b08acca23005f742a7addac882ab Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in lw-woo-gdpr-user-optins (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 105df6f835a4083e23ae8a715939002d9787e3a1f8290dcf1093dc9ae8039a9a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4427 Malicious code in lw-woo-gdpr-user-optins (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 105df6f835a4083e23ae8a715939002d9787e3a1f8290dcf1093dc9ae8039a9a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in woo-better-reviews (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 01c5fc72d3e1dfcc1d25abff23760de62aa6b51a12bd936f3e8b2ffefcc3dfa5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7212 Malicious code in woo-better-reviews (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 01c5fc72d3e1dfcc1d25abff23760de62aa6b51a12bd936f3e8b2ffefcc3dfa5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7213 Malicious code in woo-cart-expiration (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 24cfe9d8fcf65de1f13300aad8d4f80a7799b08acca23005f742a7addac882ab Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in woo-interest-in-products (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6c02a1fed016c6ea57e23f22d9ce66fd6e951fbc137f586bc556c53cc8d97a0a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7214 Malicious code in woo-interest-in-products (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6c02a1fed016c6ea57e23f22d9ce66fd6e951fbc137f586bc556c53cc8d97a0a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress WPify Woo Czech plugin <= 3.5.6 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by WPScanTeam in WordPress WPify Woo Czech plugin versions = 3.5.6. Solution Update the WordPress WPify Woo Czech plugin to the latest available version at least 3.5.7...

CVE-2022-1020 Woo Product Table < 3.1.2 - Unauthenticated Arbitrary Function Call

The Product Table for WooCommerce wooproducttable WordPress plugin before 3.1.2 does not have authorisation and CSRF checks in the wptadminupdatenoticeoption AJAX action available to both unauthenticated and authenticated users, as well as does not validate the callback parameter, allowing...

WordPress Woo Document Preview plugin <= 1.3.0 - Arbitrary Plugin Installation, Activation and Deactivation vulnerability

Arbitrary Plugin Installation, Activation and Deactivation vulnerability discovered by Mary JJ Jay in WordPress Woo Document Preview plugin versions = 1.3.0. Solution Update the WordPress Woo Document Preview plugin to the latest available version at least 1.4.0...

Woo Product Table < 3.1.2 - Unauthenticated Arbitrary Function Call

The plugin does not have authorisation and CSRF checks in the wptadminupdatenoticeoption AJAX action available to both unauthenticated and authenticated users, as well as does not validate the callback parameter, allowing unauthenticated attackers to call arbitrary functions with either none or o...

WordPress Woo Admin Product Notes plugin <= 1.0.0 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Woo Admin Product Notes plugin versions = 1.0.0. Solution No patched version available...

WordPress BSD Split Pay for Stripe Connect on Woo plugin <= 3.2.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress BSD Split Pay for Stripe Connect on Woo plugin versions = 3.2.0. Solution Update the WordPress BSD Split Pay for Stripe Connect on Woo plugin to the latest available version at least 3.2.1...

WordPress Sticky add to cart for Woo plugin <= 1.0.2 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Sticky add to cart for Woo plugin versions = 1.0.2. Solution No patched version available...

WordPress Sticky add to cart for Woo plugin <= 1.0.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Sticky add to cart for Woo plugin versions = 1.0.2. Solution No patched version available...

WordPress Product Image Watermark for Woo plugin <= 1.0.3 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Product Image Watermark for Woo plugin versions = 1.0.3. Solution Update the WordPress Product Image Watermark for Woo plugin to the latest available version at least 1.0.4...

WordPress Woo Admin Product Notes plugin <= 1.0.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Woo Admin Product Notes plugin versions = 1.0.0. Solution No patched version available...

WordPress BSD Split Pay for Stripe Connect on Woo plugin <= 3.2.0 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress BSD Split Pay for Stripe Connect on Woo plugin versions = 3.2.0. Solution Update the WordPress BSD Split Pay for Stripe Connect on Woo plugin to the latest available version at least 3.2.1...

Woo MerchantX <= 1.0 - CSRF Bypass

The plugin does not properly check for CSRF in its merchantxstepOneaddBilling, merchantxstepOne and merchantxdeletePaymentMethod functions, allowing attacker to make logged in users call them and perform unwanted actions...