3697 matches found
CVE-2023-22710
Unauth. Reflected Cross-Site Scripting XSS vulnerability in chilidevs Return and Warranty Management System for WooCommerce plugin = 1.2.3 versions...
CVE-2023-0948
The Japanized For WooCommerce WordPress plugin before 2.5.8 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting...
CVE-2023-0537
The Product Slider For WooCommerce Lite WordPress plugin through 1.1.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site...
PT-2023-16343 · WordPress · Product Slider For Woocommerce
Name of the Vulnerable Software and Affected Versions: The Product Slider For WooCommerce Lite WordPress plugin versions 1.1.7 and earlier Description: The issue is related to the plugin not validating and escaping some of its shortcode attributes before outputting them back in a page/post where...
PT-2023-13962 · WordPress · Bitcoin / Altcoin Payment Gateway For Woocommerce & Multivendor Store
Name of the Vulnerable Software and Affected Versions: Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop WordPress plugin versions 1.7.1 and earlier Description: The issue is related to a SQL injection problem. It occurs because a parameter is not properly sanitized and...
WordPress Points and Rewards for WooCommerce Plugin <= 1.5.0 is vulnerable to Settings Change
Software Points and Rewards for WooCommerce Type Plugin Vulnerable versions = 1.5.0 Fixed in 1.6.0 OWASP Top 10 A2: Broken Authentication Classification Settings Change CVE CVE-2023-27607 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 30461bd57ddb Credits Dave Jong...
CVE-2022-47449
Unauth. Reflected Cross-Site Scripting XSS vulnerability in RexTheme Cart Lift – Abandoned Cart Recovery for WooCommerce and EDD plugin = 3.1.5 versions...
CVE-2023-29170
Auth. admin+ Stored Cross-site Scripting XSS vulnerability in PI Websolution Product Enquiry for WooCommerce, WooCommerce product catalog plugin = 2.2.12 versions...
Cross site scripting
Auth. admin+ Stored Cross-site Scripting XSS vulnerability in PI Websolution Product page shipping calculator for WooCommerce plugin = 1.3.20 versions...
CVE-2023-29094
CVE-2023-29094 affects the WordPress plugin Product page shipping calculator for WooCommerce (PI Websolution), vulnerable in versions
CVE-2023-29094 WordPress Product page shipping calculator for WooCommerce Plugin <= 1.3.20 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-site Scripting XSS vulnerability in PI Websolution Product page shipping calculator for WooCommerce plugin = 1.3.20 versions...
PT-2023-22184 · Unknown · Woocommerce +1
Name of the Vulnerable Software and Affected Versions: PI Websolution Product Enquiry for WooCommerce versions 2.2.12 and earlier Description: The issue is related to a Stored Cross-site Scripting XSS vulnerability that requires authentication with admin+ privileges. This vulnerability affects th...
CVE-2022-46793
Cross-Site Request Forgery CSRF vulnerability in AdTribes.Io Product Feed PRO for WooCommerce plugin = 12.4.4 versions...
WordPress Product Enquiry for WooCommerce Plugin <= 2.2.12 is vulnerable to Cross Site Scripting (XSS)
Software Product Enquiry for WooCommerce Type Plugin Vulnerable versions = 2.2.12 Fixed in 2.2.13 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-29170 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID b43cae5ebb34 Credits Myung...
JustTables – WooCommerce Product Table < 1.5.0 - Cross-Site Request Forgery
The plugin does not adequately protect against CSRF attacks, leading to potential unauthorized actions...
WordPress Direct checkout, Add to cart redirect for Woocommerce Plugin <= 2.1.48 is vulnerable to Cross Site Scripting (XSS)
Software Direct checkout, Add to cart redirect for Woocommerce Type Plugin Vulnerable versions = 2.1.48 Fixed in 2.1.49 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-28988 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID...
WordPress Product Specifications for Woocommerce Plugin <= 0.6.0 is vulnerable to Cross Site Scripting (XSS)
Software Product Specifications for Woocommerce Type Plugin Vulnerable versions = 0.6.0 Fixed in 0.7.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-46858 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID b67f88c69a6d...
Elementor Pro < 3.11.7 - Subscriber+ Arbitrary Options Update
The plugin does not have authorisation in an AJAX action relying only on a nonce, which is available to any authenticated users, and does not validate the options to be updated. This allows any authenticated users, such as subscriber to update arbitrary blog options, such as the defaultrole, when...