CVE-2019-1010124

WebAppick WooCommerce Product Feed 2.2.18 and earlier is affected by: Cross Site Scripting XSS. The impact is: XSS to RCE via editing theme files in WordPress. The component is: admin/partials/woo-feed-manage-list.php:63. The attack vector is: Administrator must be logged in...

WordPress WebAppick WooCommerce Product Feed Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WebAppick WooCommerce Product Feed is a plugin used in WordPress to generate product feed data. A cross-site scripting...

CVE-2019-1010124

Summary: CVE-2019-1010124 affects WebAppick WooCommerce Product Feed (versions

Advanced Woo Search <= 1.68 - CSRF & XSS

CSRF leading to XSS Sanitisation against XSS added in 1.70, however no CSRF checks are performed...

WordPress Woo Checkout for Digital Goods plugin <= 2.1 - Cross-site request forgery (CSRF) vulnerability

Cross-site request forgery CSRF vulnerability found by ThreatPress Research Team in WordPress Woo Checkout for Digital Goods plugin versions = 2.1. Solution Update the WordPress Woo Checkout for Digital Goods plugin to the latest available version at least 2.2...

CVE-2018-11633

An issue was discovered in the MULTIDOTS Woo Checkout for Digital Goods plugin 2.1 for WordPress. If an admin user can be tricked into visiting a crafted URL created by an attacker via spear phishing/social engineering, the attacker can change the plugin settings. The function...

Cross site request forgery (csrf)

An issue was discovered in the MULTIDOTS Woo Checkout for Digital Goods plugin 2.1 for WordPress. If an admin user can be tricked into visiting a crafted URL created by an attacker via spear phishing/social engineering, the attacker can change the plugin settings. The function...

CVE-2018-11633

The CVE-2018-11633 issue affects the MULTIDOTS Woo Checkout for Digital Goods plugin for WordPress (version 2.1). The vulnerability stems from the function woo_checkout_settings_page in class-woo-checkout-for-digital-goods-admin.php not validating CSRF against wp-admin/admin-post.php and lacking ...

CVE-2018-11579

class-woo-banner-management.php in the MULTIDOTS WooCommerce Category Banner Management plugin 1.1.0 for WordPress has an Unauthenticated Settings Change Vulnerability, related to certain wpajaxnopriv usage. Anyone can change the plugin's setting by simply sending a request with a...

WordPress Woo Import Export 1.0 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability found by Lenon Leite in WordPress Woo Import Export version 1.0. Solution This plugin was closed on 26th January 2018 and is no longer available for download. Reason: Security Issue. Deactivate and uninstall...

WordPress Woo Import Export 1.0 Arbitrary File Deletion

...

WordPress Plugin Woo Import Export 1.0 - Arbitrary File Deletion

WordPress Plugin Woo Import Export 1.0 - Arbitrary File Deletion...

WordPress Plugin Woo Import Export 1.0 - Arbitrary File Deletion

...

WordPress Woo Import Export 1.0 Plugin - Arbitrary File Deletion Vulnerability

Exploit for php platform in category web applications 0day.today 2018-04-26...

Woo Custom Checkout Field <= 1.3.4 - CSRF & Stored XSS

Due to a lack of CSRF mitigation and entity encoding in the ccfinsert function found on line 118 of include/ccf.php and in the output generated by template/datagrid.php, it is possible to store and execute scripts in the context of an admin user. PoC...

Woo Custom Checkout Field <= 1.3.4 - CSRF & Stored XSS

Due to a lack of CSRF mitigation and entity encoding in the ccfinsert function found on line 118 of include/ccf.php and in the output generated by template/datagrid.php, it is possible to store and execute scripts in the context of an admin user...

Woo Email Control <= 1.01 - Reflected Cross-Site Scripting (XSS) & CSRF

Due to a lack of encoding and CSRF mitigation in the testemail function found on line 106 of classes/class-wooctrl.php, it is possible to automate a request to the AJAX handler for the wooctrlsendtestemail action which will reflect the specified script back to the end user. PoC...

Unfixed XSS vulnerability at www.hupo.tv

Security researcher Woo, has submitted on 09/04/2009 a cross-site-scripting XSS vulnerability affecting www.hupo.tv, which at the time of submission ranked 40792 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 30/10/2010. It is currently unfixe...

Unfixed XSS vulnerability at channel.patzzi.joins.com

Security researcher Woo, has submitted on 30/03/2009 a cross-site-scripting XSS vulnerability affecting channel.patzzi.joins.com, which at the time of submission ranked 6440 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 21/11/2011. It is...

Unfixed XSS vulnerability at news.onekoreanews.net

Security researcher Woo, has submitted on 28/03/2009 a cross-site-scripting XSS vulnerability affecting news.onekoreanews.net, which at the time of submission ranked 4643704 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 21/12/2011. It is...