3697 matches found
VulnCheck KEV: CVE-2020-36731
The Flexible Checkout Fields for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Arbitrary Plugin Settings update, in addition to Stored Cross-Site Scripting in versions up to, and including, 2.3.1. This is due to missing authorization checks on the updateSettingsAction...
CVE-2020-8819
An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce. Lack of origin authentication in the IPN callback processing function in cardgate/cardgate.php allows an attacker to remotely replace critical plugin settings merchant ID, secret key, etc. and therefore bypass...
WordPress CardGate Payments for WooCommerce plugin <= 3.1.15 - Payment Process Bypass vulnerability
Payment Process Bypass vulnerability discovered by GeekHack in WordPress CardGate Payments for WooCommerce plugin versions = 3.1.15. Solution Update the WordPress CardGate Payments for WooCommerce plugin to the latest available version at least 3.1.16...
CVE-2014-4558
Cross-site scripting XSS vulnerability in test-plugin.php in the Swipe Checkout for WooCommerce plugin 2.7.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the apiurl parameter...
WordPress facebook-for-woocommerce plugin cross-site request forgery vulnerability (CNVD-2019-30104)
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports personal blog sites on PHP and MySQL servers. facebook-for-woocommerce is a plug-in that enables marketing through Facebook. A cross-site request forgery vulnerability exis...
WordPress users-customers-import-export-for-wp-woocommerce plugin CSV injection vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. users-customers-import-export-for-wp-woocommerce is a user import/export plugin used in it. A CSV injection vulnerability exists in th...
CVE-2016-10923
The woocommerce-store-toolkit plugin before 1.5.8 for WordPress has privilege escalation...
WordPress woocommerce-pdf-invoices-packing-slips plugin cross-site scripting vulnerability
WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports PHP and MySQL servers to set up a personal blog site. woocommerce-pdf-invoices-packing-slips plugin is used in one of the invoices sent for e-commerce plugin. A cross-site...
WordPress mq-woocommerce-products-price-bulk-edit plugin cross-site scripting vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. mq-woocommerce-products-price-bulk-edit is a product price editing plugin for e-commerce used in it. A cross-site scripting...
CVE-2017-18506
The woocommerce-pdf-invoices-packing-slips plugin before 2.0.13 for WordPress has XSS via the tab or section variable on settings screens...
PT-2019-13841 · Woocommerce · Mq-Woocommerce-Products-Price-Bulk-Edit
Name of the Vulnerable Software and Affected Versions: mq-woocommerce-products-price-bulk-edit plugin version 2.0 Description: The issue allows for XSS via the "wp-admin/admin-ajax.php?action=update options" API endpoint, specifically through the show products page limit parameter. Recommendation...
CVE-2019-7441
cgi-bin/webscr?cmd=cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.8 for WordPress allows Parameter Tampering in an amount parameter such as amount1, as demonstrated by purchasing an item for lower than the intended price. NOTE: The plugin author states it is true that the amou...
Automattic: DOM based XSS in the WooCommerce plugin
I have found a stored DOM based XSS in the order page at WooCommerce 3.5.6. The Data input from HTML element name shippingstate and billingstate in order page outputs data without escaping.When the victim read the page containing the payload, it executes the script. Steps to reproduce 1. From a...
WordPress Automattic WooCommerce Plugin File Deletion Vulnerability
WordPress is the WordPress Software Foundation's set of blogging platform using PHP language development, the platform supports in PHP and MySQL servers to set up personal blog sites. automattic WooCommerce plugin is used in one of the e-commerce functionality of the plugin. logging system is one...
PT-2019-8296 · Automattic · Woocommerce
Name of the Vulnerable Software and Affected Versions: WooCommerce plugin versions prior to 3.2.4 Description: The issue allows an attack after gaining access to the target site with a user account that has at least Shop manager privileges. The attacker constructs a specifically crafted string th...
WordPress File Deletion WooCommerce Plugin Privilege Escalation
A privilege escalation vulnerability exist in WordPress File Deletion WooCommerce Plugin. The vulnerability is due to a lack of validation in file deletion. Successful exploitation of this vulnerability would allow a remote attacker to gain unauthorized access to the affected system...
Popular WooCommerce WordPress Plugin Patches Critical Vulnerability
If you own an eCommerce website built on WordPress and powered by WooCommerce plugin, then beware of a new vulnerability that could compromise your online store. Simon Scannell, a researcher at RIPS Technologies GmbH, discovered an arbitrary file deletion vulnerability in the popular WooCommerce...
Wordpress WooCommerce Plugin Deserialization Vulnerability
WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A deserialization vulnerability exists in the Wordpress WooCommerce plugin, which can be exploited by an attacker to execute...
Advanced Order Export For WooCommerce CSV Injection Vulnerability
WordPress is the WordPress Software Foundation's set of blogging platform using PHP language development, the platform supports in PHP and MySQL servers to set up a personal blog website.Advanced Order Export For WooCommerce is used in one of the export WooCommerce order data plug-ins. plugin for...
