3732 matches found
CVE-2024-10853
The Buy one click WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the removeorder AJAX action in all versions up to, and including, 2.2.9. This makes it possible for authenticated attackers, with Subscriber-level access and...
CVE-2024-12448
The Posts and Products Views for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'papvfwcviews' shortcode in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...
CVE-2024-12220
The SMS for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forg...
CVE-2024-10233
The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sasubscribe shortcode in all versions up to, and including, 3.7.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes i...
CVE-2023-28422
Auth. admin+ Stored Cross-site Scripting XSS vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce = 3.8.6. versions...
CVE-2023-0503
The Free WooCommerce Theme 99fy Extension WordPress plugin before 1.2.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack...
CVE-2023-0479
The Print Invoice & Delivery Notes for WooCommerce WordPress plugin before 4.7.2 is vulnerable to reflected XSS by echoing a GET value in an admin note within the WooCommerce orders page. This means that this vulnerability can be exploited for users with the editothersshoporders capability...
CVE-2023-0942
The Japanized For WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in versions up to, and including, 2.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...
CVE-2023-0865
The WooCommerce Multiple Customer Addresses & Shipping WordPress plugin before 21.7 does not ensure that the address to add/update/retrieve/delete and duplicate belong to the user making the request, or is from a high privilege users, allowing any authenticated users, such as subscriber to...
CVE-2023-52215
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in UkrSolution Simple Inventory Management – just scan barcode to manage products and orders. For WooCommerce.This issue affects Simple Inventory Management – just scan barcode to manage products and...
CVE-2023-30492
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Vark Minimum Purchase for WooCommerce plugin = 2.0.0.1 versions...
CVE-2023-30747
Unauth. Reflected Cross-Site Scripting XSS vulnerability in WPGem WooCommerce Easy Duplicate Product plugin = 0.3.0.0 versions...
CVE-2023-47696
Unauth. Stored Cross-Site Scripting XSS vulnerability in Gravity Master Product Enquiry for WooCommerce plugin = 3.0 versions...
CVE-2023-47658
Auth. ShopManager+ Stored Cross-Site Scripting XSS vulnerability in actpro Extra Product Options for WooCommerce plugin = 3.0.3 versions...
CVE-2023-47660
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WP Wham Product Visibility by Country for WooCommerce plugin = 1.4.9 versions...
CVE-2023-29094
Auth. admin+ Stored Cross-site Scripting XSS vulnerability in PI Websolution Product page shipping calculator for WooCommerce plugin = 1.3.20 versions...
CVE-2023-29423
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in PI Websolution Cancel order request / Return order / Repeat Order / Reorder for WooCommerce plugin = 1.3.2 versions...
CVE-2023-41874
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Tyche Softwares Order Delivery Date for WooCommerce plugin = 3.20.0 versions...