Woo MerchantX <= 1.0 - CSRF Bypass

The plugin does not properly check for CSRF in its merchantxstepOneaddBilling, merchantxstepOne and merchantxdeletePaymentMethod functions, allowing attacker to make logged in users call them and perform unwanted actions...

WordPress Advanced Woo Search Plugin < 2.00 Information Disclosure Vulnerability

The WordPress plugin Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

WordPress Advanced Woo Search Information Disclosure Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Advanced Woo Search is a search plugin used in it. An information disclosure vulnerability exists in ajax query requests in Wordpress...

CVE-2020-12070

The Advanced Woo Search plugin version through 1.99 for Wordpress suffers from a sensitive information disclosure vulnerability in every ajax search request via the sql field to includes/class-aws-search.php...

CVE-2020-12070

Summary: The WordPress plugin Advanced Woo Search (versions up to 1.99) exposes a sensitive information disclosure vulnerability. According to multiple connected sources, every ajax search request over the sql field in includes/class-aws-search.php can disclose sensitive data. The issue is docume...

Advanced Woo Search < 2.00 - SQL query leak in ajax search

Every ajax search returns the raw SQL query in the response...

WordPress Advanced Woo Search plugin <= 1.99 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability found in WordPress Advanced Woo Search plugin versions = 1.99. Solution Update the WordPress Advanced Woo Search plugin to the latest available version at least 2.00...

CVE-2019-11325: Fix escaping of strings in VarExporter

Affected versions Symfony 4.2.0 to 4.2.11 and 4.3.0 to 4.3.7 versions of the Symfony VarExporter component are affected by this security issue. The issue has been fixed in Symfony 4.2.12 and 4.3.8. Description Some strings were not properly escaped when being dumped by the VarExporter component...

Feds Shut Down Largest Dark Web Child Abuse Site; South Korean Admin Arrested

The United States Department of Justice said today that they had arrested hundreds of criminals in a global crackdown after taking down the largest known child porn site on the dark web and tracing payments made in bitcoins. With an international coalition of law enforcement agencies, federal...

WordPress woo-address-book plugin cross-site request forgery vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. woo-address-book is a plugin for e-commerce sites that uses it to manage shipping addresses. A cross-site request forgery vulnerabilit...

WordPress woo-variation-gallery cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. woo-variation-gallery is a plugin for e-commerce sites that adds images to products. A cross-site scripting vulnerability exists in...

WordPress woo-confirmation-email plugin has unspecified vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. woo-confirmation-email is a plugin used in it to send email verification code. A security vulnerability exists in the WordPress...

CVE-2019-15778

The woo-variation-gallery plugin before 1.1.29 for WordPress has XSS...

CVE-2019-15778

The woo-variation-gallery plugin before 1.1.29 for WordPress has XSS...

CVE-2019-15778

The CVE-2019-15778 entry concerns the WordPress plugin woo-variation-gallery, affected in versions prior to 1.1.29, which is described as having a cross-site scripting (XSS) vulnerability. The vulnerability is rooted in improper handling/validation of client-side data, enabling XSS. Remediation a...

CVE-2019-15770

The woo-address-book plugin before 1.6.0 for WordPress has save calls without nonce verification checks...

CVE-2018-21007

The woo-confirmation-email plugin before 3.2.0 for WordPress has no blocking of direct access to supportive xl folders inside uploads...

CVE-2018-21007

The CVE-2018-21007 entry affects the WordPress plugin woo-confirmation-email before version 3.2.0 . The vulnerability is an authorization flaw: the plugin does not block direct access to supportive files/folders inside the WordPress uploads directory, exposing potentially sensitive uploaded conte...

WordPress woo-variation-swatches plugin cross-site scripting vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress woo-variation-swatches plugin. The vulnerability stems from the...

CVE-2019-14774

Vulnerability detail: The woo-variation-swatches (Variation Swatches for WooCommerce) WordPress plugin, version 1.0.61, is affected by a reflected XSS flaw in the admin settings endpoint wp-admin/admin.php?page=woo-variation-swatches-settings via the tab parameter. Impactfully, this allows script...