CVE-2024-8678

The Revolut Gateway for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wc/v3/revolut REST API endpoint in all versions up to, and including, 4.17.3. This makes it possible for unauthenticated attackers to mark orders a...

CVE-2024-7491

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.6.1 via the woofmessengerremovesubscr AJAX action due to missing validation on the 'key' user controlled key. This makes it...

WordPress plugin Revolut Gateway for WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A security vulnerability exists in...

CVE-2024-8716

The XT Ajax Add To Cart for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2024-8716

The XT Ajax Add To Cart for WooCommerce plugin (WordPress) is affected by CVE-2024-8716: Reflected Cross-Site Scripting due to improper escaping of add_query_arg in the URL for all versions up to 1.1.2. The vulnerability is exploitable by unauthenticated attackers who can entice a user to perform...

WordPress XT Ajax Add To Cart for WooCommerce plugin <= 1.1.2 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin XT Ajax Add To Cart for WooCommerce versions = 1.1.2...

PT-2024-39172 · WordPress · Revolut Gateway For Woocommerce

Name of the Vulnerable Software and Affected Versions: Revolut Gateway for WooCommerce plugin for WordPress versions up to, and including, 4.17.3 Description: The issue is related to unauthorized modification of data due to a missing capability check on the "/wc/v3/revolut" REST API endpoint. Thi...

PT-2024-39196 · WordPress · Xt Ajax Add To Cart For Woocommerce

Name of the Vulnerable Software and Affected Versions: XT Ajax Add To Cart for WooCommerce plugin for WordPress versions up to, and including, 1.1.2 Description: The issue is related to Reflected Cross-Site Scripting due to the use of add query arg without appropriate escaping on the URL. This...

WordPress Product Carousel Slider & Grid Ultimate for WooCommerce plugin <= 1.9.10 - Authenticated Local File Inclusion vulnerability

Authenticated Local File Inclusion vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin Product Carousel Slider & Grid Ultimate for WooCommerce versions = 1.9.10...

The vulnerability of the InPost plugins for WooCommerce and the InPost PL plugin for WordPress allows a hacker to execute arbitrary code.

The vulnerability of InPost plugins for WooCommerce and the InPost PL plugin for WordPress involves a lack of authentication. Exploiting this vulnerability allows a malicious actor to execute arbitrary code...

PT-2024-31649 · Pickplugins · Pickplugins Product Slider For Woocommerce

Name of the Vulnerable Software and Affected Versions: PickPlugins Product Slider for WooCommerce versions 1.13.50 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS,...

CVE-2024-8271

The The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.4.2.1. This is due to the software allowing users to execute an action that does not properly validate a value before running...

CVE-2024-8271 FOX – Currency Switcher Professional for WooCommerce <= 1.4.2.1 - Unauthenticated Arbitrary Shortcode Execution

The The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.4.2.1. This is due to the software allowing users to execute an action that does not properly validate a value before running...

CVE-2024-8277

The WooCommerce Photo Reviews Premium plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.3.13.2. This is due to the plugin not properly validating what user transient is being used in the login function and not properly verifying the user's identit...

PT-2024-38907 · WordPress · Woocommerce Photo Reviews Premium

Name of the Vulnerable Software and Affected Versions: WooCommerce Photo Reviews Premium plugin for WordPress versions up to, and including, 1.3.13.2 Description: The issue is due to the plugin not properly validating what user transient is being used in the login function and not properly...

CVE-2024-8289

The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to privilege escalation/de-escalation and account takeover due to an insufficient capability check on the updateitempermissionscheck and createitempermissionscheck functions in all...

WordPress EU/UK VAT Manager for WooCommerce plugin <= 2.12.14 - CSRF to Cross Site Scripting (XSS) vulnerability

CSRF to Cross Site Scripting XSS vulnerability discovered by Abdi Pranata Patchstack Alliance in WordPress Plugin EU/UK VAT Manager for WooCommerce versions = 2.12.14...

WordPress E-cab taxi booking manager plugin <= 1.0.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Sharanabasappa Patchstack Alliance in WordPress Plugin Taxi Booking Manager for WooCommerce versions = 1.0.9...

PT-2024-30850 · Woocommerce · Taxi Booking Manager For Woocommerce

Name of the Vulnerable Software and Affected Versions: Taxi Booking Manager for WooCommerce versions through 1.0.9 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS, where an attacke...

WordPress plugin Taxi Booking Manager for WooCommerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...