CVE-2024-0432

CVE-2024-0432 concerns the Gestpay for WooCommerce plugin for WordPress. The issue is a CSRF vulnerability caused by missing or incorrect nonce validation in the ajax_delete_card function across versions up to 20221130. This enables unauthenticated attackers to delete a user’s default card token ...

PT-2024-15556 · WordPress · Gestpay For Woocommerce

Name of the Vulnerable Software and Affected Versions: Gestpay for WooCommerce plugin for WordPress versions up to, and including, 20221130 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the ajax delete card function. This allows...

PT-2024-15804 · Envo · Elementor Templates & Widgets For Woocommerce

Name of the Vulnerable Software and Affected Versions: The Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress versions up to, and including, 1.4.4 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the ajax plugin...

PT-2024-14879 · Mollie · Mollie Payments For Woocommerce

Name of the Vulnerable Software and Affected Versions: Mollie Payments for WooCommerce versions prior to 7.3.12 Description: The issue is related to an Unrestricted Upload of File with Dangerous Type, which affects the Mollie Payments for WooCommerce plugin. Recommendations: For versions prior to...

PT-2024-15805 · Envo · Elementor Templates & Widgets For Woocommerce

Name of the Vulnerable Software and Affected Versions: The Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress versions up to and including 1.4.4 Description: The issue is due to missing or incorrect nonce validation on the ajax theme activation function, making it possible...

CVE-2024-1686

The Thank You Page Customizer for WooCommerce – Increase Your Sales plugin for WordPress is vulnerable to missing authorization e in all versions up to, and including, 1.1.2 via the applylayout function due to a missing capability check. This makes it possible for authenticated attackers, with...

CVE-2024-1686 Thank You Page Customizer for WooCommerce – Increase Your Sales <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Data Export

The Thank You Page Customizer for WooCommerce – Increase Your Sales plugin for WordPress is vulnerable to missing authorization e in all versions up to, and including, 1.1.2 via the applylayout function due to a missing capability check. This makes it possible for authenticated attackers, with...

WordPress Plugin Thank You Page Customizer for WooCommerce Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

CVE-2024-1758

The SuperFaktura WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.40.3 via the wcsfurlcheck function. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary...

Server side request forgery (ssrf)

The SuperFaktura WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.40.3 via the wcsfurlcheck function. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary...

PT-2024-18222 · WordPress · The Thank You Page Customizer For Woocommerce

Name of the Vulnerable Software and Affected Versions: The Thank You Page Customizer for WooCommerce – Increase Your Sales plugin for WordPress versions up to, and including, 1.1.2 Description: The issue is related to missing authorization in the plugin, specifically due to a missing capability...

WordPress Plugin WooCommerce Easy Checkout Field Editor, Fees & Discounts Code Issue Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress Plugin WooCommerce Easy Checkout...

WordPress Cost of Goods for WooCommerce Plugin <= 3.2.8 is vulnerable to Cross Site Scripting (XSS)

Software Cost of Goods for WooCommerce Type Plugin Vulnerable versions = 3.2.8 Fixed in 3.2.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0821 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 06f40e6d3a9e Credits...

PT-2024-16285 · WordPress · Customer Reviews For Woocommerce

Name of the Vulnerable Software and Affected Versions: Customer Reviews for WooCommerce plugin for WordPress versions up to, and including, 5.38.12 Description: The issue allows unauthorized modification of data due to a missing capability check on the submit review function. This enables...

PT-2024-14144 · Woocommerce · Pay With Vipps/Mobilepay For Woocommerce

Name of the Vulnerable Software and Affected Versions: Pay with Vipps and MobilePay for WooCommerce versions 1.14.13 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This mean...

CVE-2024-24834

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in realmag777 BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net allows Stored XSS.This issue affects BEAR – Bulk Editor and Products Manager Professional for...

CVE-2024-24878

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PT Woo Plugins by Webdados Portugal CTT Tracking for WooCommerce allows Reflected XSS.This issue affects Portugal CTT Tracking for WooCommerce: from n/a through 2.1...

CVE-2024-0797 Active Products Tables for WooCommerce. Professional products tables for WooCommerce store <= 1.0.6.1 - Missing Authorization

The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on several functions in all versions up to, and including, 1.0.6.1. This makes it possible fo...

CVE-2024-24841

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Dan's Art Add Customer for WooCommerce allows Stored XSS.This issue affects Add Customer for WooCommerce: from n/a through 1.7...

WordPress plugin Active Products Tables for WooCommerce. professional products tables for WooCommerce store Security Vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...