WordPress WooCommerce Product Table Lite Plugin <= 3.5.1 is vulnerable to Cross Site Scripting (XSS)

Software WooCommerce Product Table Lite Type Plugin Vulnerable versions = 3.5.1 Fixed in 3.8.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6458 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID b99493f3472e Credits Luc...

WordPress WooCommerce Report Plugin <= 1.4.5 is vulnerable to Cross Site Scripting (XSS)

Software WooCommerce Report Type Plugin Vulnerable versions = 1.4.5 Fixed in 1.5.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-38683 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID d2a44e699bc6 Credits Le Ngoc Anh Required privileg...

WordPress Woocommerce OpenPos Plugin <= 7.0.1 is vulnerable to Broken Access Control

Software Woocommerce OpenPos Type Plugin Vulnerable versions = 7.0.1 Fixed in 7.0.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-37935 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID d6898ddc425e Credits Dave Jong Patchstack...

WordPress WooCommerce Social Login Plugin <= 2.6.3 is vulnerable to PHP Object Injection

Software WooCommerce Social Login Type Plugin Vulnerable versions = 2.6.3 Fixed in 2.7.0 OWASP Top 10 A5: Security Misconfiguration Classification PHP Object Injection CVE CVE-2024-37502 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 642655a733d8 Credits Ananda Dhak...

WordPress WooCommerce Social Login Plugin <= 2.6.2 is vulnerable to PHP Object Injection

Software WooCommerce Social Login Type Plugin Vulnerable versions = 2.6.2 Fixed in 2.6.3 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-5871 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 26c69110d799 Credits István Márton Required privilege...

WordPress WooCommerce Social Login Plugin <= 2.6.2 is vulnerable to Broken Access Control

Software WooCommerce Social Login Type Plugin Vulnerable versions = 2.6.2 Fixed in 2.6.3 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-5868 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID c239d7880ed2 Credits István Márton Require...

CVE-2024-31267 WordPress Flexible Checkout Fields for WooCommerce plugin <= 4.1.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP Desk Flexible Checkout Fields for WooCommerce.This issue affects Flexible Checkout Fields for WooCommerce: from n/a through 4.1.2...

WordPress WooCommerce Dropshipping plugin <= 5.1.2 - Unauthenticated Arbitrary Email Sending vulnerability

Unauthenticated Arbitrary Email Sending vulnerability discovered by Dave Jong Patchstack in WordPress Plugin WooCommerce Dropshipping versions = 5.1.2...

WordPress WooCommerce Tools Plugin <= 1.2.9 is vulnerable to Broken Access Control

Software WooCommerce Tools Type Plugin Vulnerable versions = 1.2.9 Fixed in 1.2.10 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1689 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID dd5e30ec3dbb Credits Lucio Sá Required privilege...

WordPress WooCommerce Dropshipping Plugin <= 5.1.2 is vulnerable to Content Spoofing

Software WooCommerce Dropshipping Type Plugin Vulnerable versions = 5.1.2 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Content Spoofing CVE CVE-2024-35748 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID ecc612ac7455 Credits Dave Jong Patchstack Requir...

WordPress WooCommerce PDF Invoices & Packing Slips Plugin <= 3.8.0 is vulnerable to Server Side Request Forgery (SSRF)

Software WooCommerce PDF Invoices & Packing Slips Type Plugin Vulnerable versions = 3.8.0 Fixed in 3.8.1 OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2024-3047 Patch priority Medium CVSS severity Medium 7.2 Developer Claim ownership PSID 6d237d7ae9e9 Credits...

WordPress WooCommerce Customers Manager Plugin < 29.8 is vulnerable to Cross Site Scripting (XSS)

Software WooCommerce Customers Manager Type Plugin Vulnerable versions 29.8 Fixed in 29.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1743 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 088073d3e0c4 Credits Erwan LR...

WordPress WooCommerce Shipping Label Plugin <= 2.3.8 is vulnerable to Cross Site Scripting (XSS)

Software WooCommerce Shipping Label Type Plugin Vulnerable versions = 2.3.8 Fixed in 2.3.9 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32834 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID a0358e31252f Credits Joshua Chan Required...

CVE-2024-32585: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in extendWP Import Content in WordPress & WooCommerce with Excel allows Reflected XSS.This issue affects Import Content in WordPress & WooCommerce with Excel: from n/a through 4.2...

WordPress Import Content in WordPress & WooCommerce with Excel plugin <= 4.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Yudistira Arya Patchstack Alliance in WordPress Plugin Import Content in WordPress & WooCommerce with Excel versions = 4.2...

WordPress WooCommerce Multilingual & Multicurrency Plugin <= 5.3.3.1 is vulnerable to SQL Injection

Software WooCommerce Multilingual & Multicurrency Type Plugin Vulnerable versions = 5.3.3.1 Fixed in 5.3.4 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-32602 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID b58e38f053fe Credits Rafie Muhammad...

WordPress WooCommerce Customers Manager Plugin < 29.7 is vulnerable to SQL Injection

Software WooCommerce Customers Manager Type Plugin Vulnerable versions 29.7 Fixed in 29.7 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-0399 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 3c8fe0630d48 Credits Ivan Spiridonov Required privilege...

CVE-2024-2343: Server-Side Request Forgery (SSRF)

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.11.6 via the formtourlaction function. This makes it possible for authenticated attackers, with contributor-level access and above, to...

WordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels Plugin <= 4.4.2 is vulnerable to Broken Access Control

Software WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels Type Plugin Vulnerable versions = 4.4.2 Fixed in 4.4.3 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-3216 Patch priority Low CVSS severity Low 5.3 Developer Claim...

CVE-2024-22155 WordPress WooCommerce plugin <= 8.5.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Automattic WooCommerce.This issue affects WooCommerce: from n/a through 8.5.2...