PT-2024-30327 · Magepeople Team · Event Manager For Woocommerce

Name of the Vulnerable Software and Affected Versions: Event Manager for WooCommerce versions n/a through 4.2.1 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a 'Path Traversal' vulnerability, in MagePeople Team Event Manager for...

WordPress plugin HitPay Payment Gateway for WooCommerce has a vulnerability related to information leakage

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An information disclosure...

WordPress Order Export for WooCommerce plugin <= 3.23 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Plugin Order Export for WooCommerce versions = 3.23...

WordPress Order Export for WooCommerce Plugin <= 3.23 is vulnerable to Sensitive Data Exposure

Software Order Export for WooCommerce Type Plugin Vulnerable versions = 3.23 Fixed in 3.24 OWASP Top 10 A9: Security Logging and Monitoring Failures Classification Sensitive Data Exposure CVE CVE-2024-43259 Patch priority Low CVSS severity Low 5.3 Developer WebFactory Ltd. PSID 49e9304e587a Credi...

WordPress plugin Sender – Newsletter, SMS, and Email Marketing Automation for WooCommerce Cross-site scripting vulnerabilities

WordPress and WordPress plugin are products of the WordPress Foundation, a blogging platform developed in PHP. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress plugin Sender - Newsletter,...

WordPress Persian WooCommerce plugin <= 7.1.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin Persian WooCommerce versions = 7.1.6...

CVE-2024-6987

The CVE-2024-6987 entry concerns the Orchid Store WordPress theme. The documented root cause is a missing capability check in orchid_store_activate_plugin, enabling unauthorized data modification by authenticated users with Subscriber-level access and above to activate the Addonify Floating Cart ...

CVE-2024-6987 Orchid Store <= 1.5.6 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Activation

The Orchid Store theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'orchidstoreactivateplugin' function in all versions up to, and including, 1.5.6. This makes it possible for authenticated attackers, with Subscriber-level access and...

WordPress Products, Order & Customers Export for WooCommerce Plugin <= 2.0.11 is vulnerable to Cross Site Scripting (XSS)

Software Products, Order & Customers Export for WooCommerce Type Plugin Vulnerable versions = 2.0.11 Fixed in 2.0.12 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43127 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 0c64f76a48fe...

WordPress Event Manager for WooCommerce Plugin <= 4.2.1 is vulnerable to Local File Inclusion

Software Event Manager for WooCommerce Type Plugin Vulnerable versions = 4.2.1 Fixed in 4.2.2 OWASP Top 10 A1: Broken Access Control Classification Local File Inclusion CVE CVE-2024-43138 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 721149c5cd33 Credits João Pedro S...

CVE-2024-1747

The WooCommerce Customers Manager WordPress plugin before 30.2 does not have authorisation and CSRF in various AJAX actions, allowing any authenticated users, such as subscriber, to call them and update/delete/create customer metadata, also leading to Stored Cross-Site Scripting due to the lack o...

WordPress WooCommerce Product Table Lite plugin <= 3.5.1 - Missing Authorization to (Subscriber+) Stored Cross-Site Scripting vulnerability

Missing Authorization to Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Lucio Sá in WordPress Plugin WooCommerce Product Table Lite versions = 3.5.1...

PT-2024-37722 · WordPress · Aramex Shipping Woocommerce

Name of the Vulnerable Software and Affected Versions: Aramex Shipping WooCommerce plugin for WordPress versions up to, and including, 1.1.21 Description: The issue allows unauthenticated attackers to retrieve the full path of the web application, which can aid other attacks. This is due to the...

WordPress plugin Aramex Shipping WooCommerce has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-6566: Exposure of Sensitive Information to an Unauthorized Actor

The Aramex Shipping WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.1.21. This is due the plugin not preventing direct access to the composer-setup.php file which also has displayerrors enabled. This makes it possible for...

WordPress Mercado Pago payments for WooCommerce Plugin 7.3.0 - 7.6.1 is vulnerable to Arbitrary File Download

Software Mercado Pago payments for WooCommerce Type Plugin Vulnerable versions 7.3.0 - 7.6.1 Fixed in 7.6.2 OWASP Top 10 A3: Sensitive Data Exposure Classification Arbitrary File Download CVE CVE-2024-3934 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID e624a5a01127...

CVE-2024-38669 WordPress Predictive Search for WooCommerce plugin <= 6.0.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in a3rev Software WooCommerce Predictive Search allows Reflected XSS.This issue affects WooCommerce Predictive Search: from n/a through 6.0.1...

CVE-2024-6560 Addonify – Quick View For WooCommerce <= 1.2.16 - Unauthenticated Full Path Dislcosure

The Addonify – Quick View For WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2.16. This is due the plugin utilizing mobiledetect without preventing direct access to the files. This makes it possible for unauthenticated attackers to...

PT-2024-28458 · WordPress · Mercado Pago Payments For Woocommerce

Name of the Vulnerable Software and Affected Versions: Mercado Pago payments for WooCommerce plugin for WordPress versions 7.3.0 through 7.5.1 Description: The issue allows authenticated attackers with subscriber-level access and above to download and read the contents of arbitrary files on the...

CVE-2024-6799

The YITH Essential Kit for WooCommerce 1 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'activatemodule', 'deactivatemodule', and 'installmodule' functions in all versions up to, and including, 2.34.0. This makes it possible for...