CVE-2022-47164 WordPress Event Manager for WooCommerce Plugin <= 3.7.7 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce plugin = 3.7.7 versions...

WordPress plugin Thank You Page Customizer for WooCommerce – Increase Your Sales 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. WordPress plugin Thank You Page...

PT-2023-15054 · Villatheme · Villatheme Thank You Page Customizer For Woocommerce

Name of the Vulnerable Software and Affected Versions: VillaTheme Thank You Page Customizer for WooCommerce – Increase Your Sales plugin versions = 1.0.13 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a...

WordPress plugin Event Manager and Tickets Selling Plugin for WooCommerce 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...

PT-2023-14655 · Tyche Softwares · Custom Order Numbers For Woocommerce

Name of the Vulnerable Software and Affected Versions: Tyche Softwares Custom Order Numbers for WooCommerce plugin versions = 1.4.0 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing...

PT-2023-14004 · Woocommerce · Zorem Advanced Shipment Tracking

Name of the Vulnerable Software and Affected Versions: Zorem Advanced Shipment Tracking for WooCommerce plugin versions = 3.5.2 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to perform unintended actions on a we...

PT-2023-15055 · WordPress · Villatheme Thank You Page Customizer For Woocommerce

Name of the Vulnerable Software and Affected Versions: VillaTheme Thank You Page Customizer for WooCommerce – Increase Your Sales plugin versions prior to 1.0.14 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to...

WordPress plugin Custom Order Numbers for WooCommerce 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...

PT-2023-15207 · WordPress · Magepeople Team Event Manager/Tickets Selling Plugin For Woocommerce

Name of the Vulnerable Software and Affected Versions: MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce plugin versions = 3.7.7 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a us...

CVE-2022-46794

Cross-Site Request Forgery CSRF vulnerability in weightbasedshipping.Com WooCommerce Weight Based Shipping plugin = 5.4.1 versions...

CVE-2023-23667

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in BeRocket Brands for WooCommerce plugin = 3.7.0.6 versions...

CVE-2023-2706 OTP Login Woocommerce & Gravity Forms <= 2.2 - Authentication Bypass to Privilege Escalation

The OTP Login Woocommerce & Gravity Forms plugin for WordPress is vulnerable to authentication bypass. This is due to the fact that when generating OTP codes for users to use in order to login via phone number, the plugin returns these codes in an AJAX response. This makes it possible for...

CVE-2023-1839 Product Addons & Fields for WooCommerce < 32.0.6 - Admin+ Stored Cross-Site Scripting

The Product Addons & Fields for WooCommerce WordPress plugin before 32.0.6 does not sanitize and escape some of its setting fields, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example...

CVE-2023-2179 WooCommerce Order Status Change Notifier <= 1.1.0 - Subscriber+ Arbitrary Order Status Update

The WooCommerce Order Status Change Notifier WordPress plugin through 1.1.0 does not have authorisation and CSRF when updating status orders via an AJAX action available to any authenticated users, which could allow low privilege users such as subscriber to update arbitrary order status, making...

WordPress plugin Product Addons & Fields for WooCommerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2023-17272 · WordPress · Addons & Fields For Woocommerce

Name of the Vulnerable Software and Affected Versions: Product Addons & Fields for WooCommerce WordPress plugin version 32.0.5 and earlier Description: The issue allows high-privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability i...

CVE-2022-46858 WordPress Product Specifications for Woocommerce Plugin <= 0.6.0 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Amin A.Rezapour Product Specifications for Woocommerce plugin = 0.6.0 versions...

CVE-2022-46858

CVE-2022-46858 affects the WordPress plugin Product Specifications for Woocommerce (Amin A. Rezapour) up to version 0.6.0 . The issue is an unauthenticated, reflected Cross-Site Scripting (XSS) via arbitrary query string parameters, enabling injected scripts when users visit a crafted URL. Public...

PT-2023-15083 · Unknown · Woocommerce

Name of the Vulnerable Software and Affected Versions: Amin A.Rezapour Product Specifications for Woocommerce plugin versions 0.6.0 and earlier Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This allows for malicious scripts to be injected into a...

PT-2023-15066 · WordPress · Woocommerce Jazzcash Gateway Plugin

Name of the Vulnerable Software and Affected Versions: WooCommerce JazzCash Gateway Plugin versions prior to 2.1 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially...