CVE-2021-38341 WooCommerce Payment Gateway Per Category <= 2.0.10 Reflected Cross-Site Scripting

The WooCommerce Payment Gateway Per Category WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /includes/pluginsettings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.10...

WordPress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress Plugin is an open source application plugin for WordPress. The WorkPress Plugin suffers from a cross-sit...

WordPress Total Sales For Woocommerce plugin <= 1.1 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by iohex and WPScanTeam in WordPress Total Sales For Woocommerce plugin versions = 1.1. Solution 2021-08-27 - no patched version available...

Zero-Day Attacks on Critical WooCommerce Bug Threaten Databases

A critical SQL-injection security vulnerability in the WooCommerce e-commerce platform and a related plugin has been under attack as a zero-day bug, researchers have disclosed. The exploitation prompted WooCommerce to release an emergency patch for the issue late on Wednesday. The bug could allow...

WordPress PickPlugins Product Slider for WooCommerce Cross-Site Scripting Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in the WooCommerce WordPress plugin for PickPlugins Product slider...

CVE-2021-24300

The slider import search feature of the PickPlugins Product Slider for WooCommerce WordPress plugin before 1.13.22 did not properly sanitised the keyword GET parameter, leading to reflected Cross-Site Scripting issue...

WordPress 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in the WooCommerce WordPress plugin for PickPlugins Product slider...

CVE-2021-24169

This Advanced Order Export For WooCommerce WordPress plugin before 3.1.8 helps you to easily export WooCommerce order data. The tab parameter in the Admin Panel is vulnerable to reflected XSS...

CVE-2021-24169

This Advanced Order Export For WooCommerce WordPress plugin before 3.1.8 helps you to easily export WooCommerce order data. The tab parameter in the Admin Panel is vulnerable to reflected XSS...

CVE-2021-24171 WooCommerce Upload Files < 59.4 - Unauthenticated Arbitrary File Upload

The WooCommerce Upload Files WordPress plugin before 59.4 ran a single sanitization pass to remove blocked extensions such as .php. It was possible to bypass this and upload a file with a PHP extension by embedding a "blocked" extension within another "blocked" extension in the "wcuffilename"...

PT-2021-15715 · WordPress · Advanced Order Export For Woocommerce

Name of the Vulnerable Software and Affected Versions: Advanced Order Export For WooCommerce WordPress plugin versions prior to 3.1.8 Description: The issue affects the Advanced Order Export For WooCommerce WordPress plugin, where the tab parameter in the Admin Panel is vulnerable to reflected XS...

WooCommerce for WordPress 代码问题漏洞

Automattic WooCommerce is the United States Automattic company's set of open source e-commerce platform based on WordPress . A security vulnerability exists in YITH WooCommerce Gift Cards Premium plugin before 3.3.1 for WordPress, which can be exploited by remote attackers to achieve remote code...

WooCommerce Permission License and Access Control Issues Vulnerability

WooCommerce is an open source WordPress e-commerce plugin. WooCommerce versions prior to 4.7.0 are vulnerable to privilege permission and access control issues, which can be exploited by a remote attacker to view the status of any order via the orderid parameter in the fetchorderstatus operation...

EUVD-2022-5657

The WooCommerce plugin before 4.7.0 for WordPress allows remote attackers to view the status of arbitrary orders via the orderid parameter in a fetchorderstatus action...

Discount Rules for WooCommerce Plugin for WordPress < 2.1.0 Multiple Vulnerabilities

The WordPress Discount Rules for WooCommerce Plugin installed on the remote host is affected by SQL injection and unauthenticated stored Cross-Site Scripting XSS vulnerabilities. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported...

CVE-2020-11497

An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. An online payment system bypass allows orders to be marked as fully paid by assigning an arbitrary bank transaction ID during the payment-details entry step...

CVE-2020-11497

An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. An online payment system bypass allows orders to be marked as fully paid by assigning an arbitrary bank transaction ID during the payment-details entry step...

WordPress Discount Rules for WooCommerce plugin <= 2.0.2 - Multiple (XSS, SQLi) Vulnerabilities

Multiple XSS, SQLi Vulnerabilities found by WebARX Security in WordPress Discount Rules for WooCommerce plugin versions = 2.0.2. Solution Update the WordPress Discount Rules for WooCommerce plugin to the latest available version at least 2.1.0...

CVE-2020-11727

A cross-site scripting XSS vulnerability in the AlgolPlus Advanced Order Export For WooCommerce plugin 3.1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the view/settings-form.php woeposttype parameter...

WordPress users-customers-import-export-for-wp-woocommerce injection vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. users-customers-import-export-for-wp-woocommerce is a user import and export plugin used in it. A security vulnerability exists in...