CVE-2024-0399

The WooCommerce Customers Manager WordPress plugin before 29.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by Subscriber+ role...

WordPress Plugin Email Marketing for WooCommerce by Omnisend 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress Plugin Email Marketi...

PT-2024-14972 · WordPress · Wpc Smart Quick View

Name of the Vulnerable Software and Affected Versions: WPC Smart Quick View for WooCommerce plugin for WordPress versions up to, and including, 4.0.2 Description: The issue is related to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. Thi...

WordPress Plugin WPC Smart Quick View for WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

WordPress Wallet System for WooCommerce plugin <= 2.5.9 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Plugin Wallet System for WooCommerce versions = 2.5.9...

WordPress Email Marketing for WooCommerce plugin <= 1.14.3 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin Email Marketing for WooCommerce by Omnisend versions = 1.14.3...

PT-2024-24411 · Elex · Elex Woocommerce Dynamic Pricing/Discounts

Name of the Vulnerable Software and Affected Versions: ELEX WooCommerce Dynamic Pricing and Discounts versions n/a through 2.1.2 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. It affects the ELEX WooCommerce Dynamic Pricing and Discounts plugin. Recommendations: For...

WordPress ELEX WooCommerce Dynamic Pricing and Discounts Plugin <= 2.1.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software ELEX WooCommerce Dynamic Pricing and Discounts Type Plugin Vulnerable versions = 2.1.2 Fixed in 2.1.3 OWASP Top 10 A5: Security Misconfiguration Classification Cross Site Request Forgery CSRF CVE CVE-2024-32105 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID...

WordPress Extra Product Options Builder for WooCommerce plugin <= 1.2.104 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin Extra Product Options Builder for WooCommerce versions = 1.2.104...

WordPress Product Input Fields for WooCommerce plugin <= 1.7.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin Product Input Fields for WooCommerce versions = 1.7.0...

WordPress Currency per Product for WooCommerce Plugin <= 1.6.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Currency per Product for WooCommerce Type Plugin Vulnerable versions = 1.6.0 Fixed in 1.7.0 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-31920 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 9bdf124686da Credit...

WordPress Wholesale For WooCommerce plugin <= 2.3.1 - Unauthenticated Arbitrary Post/Page vulnerability

Unauthenticated Arbitrary Post/Page vulnerability discovered by Dave Jong Patchstack in WordPress Plugin Wholesale For WooCommerce versions = 2.3.0...

WordPress Advanced Local Pickup for WooCommerce plugin <=1.6.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Majed Refaea Patchstack Alliance in WordPress Plugin Advanced Local Pickup for WooCommerce versions = 1.6.2...

WordPress Products, Order & Customers Export for WooCommerce Plugin <= 2.0.8 is vulnerable to Broken Access Control

Software Products, Order & Customers Export for WooCommerce Type Plugin Vulnerable versions = 2.0.8 Fixed in 2.0.9 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31276 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 34e66eca8be4...

Booster for WooCommerce < 7.1.8 - Reflected Cross-Site Scripting

Description The Booster for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 7.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

PT-2024-23769 · Woocommerce · Festi-Team Popup Cart Lite For Woocommerce

Name of the Vulnerable Software and Affected Versions: Festi-Team Popup Cart Lite for WooCommerce versions 1.1 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software. This type of issue allows an attacker to trick a user into performing unintended actions on a web...

WordPress Popup Cart Lite for WooCommerce plugin <= 1.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Skalucy Patchstack Alliance in WordPress Plugin Popup Cart Lite for WooCommerce versions = 1.1...

WordPress New Order Notification for Woocommerce plugin <= 2.0.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Yudistira Arya Patchstack Alliance in WordPress Plugin New Order Notification for Woocommerce versions = 2.0.2...

CVE-2024-3061

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.5.2 via the 'type' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to include and...

WordPress WPC Badge Management for WooCommerce plugin <= 2.4.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Abdi Pranata Patchstack Alliance in WordPress Plugin WPC Badge Management for WooCommerce versions = 2.4.0...