WordPress Woocommerce Email Report Plugin <= 2.4 is vulnerable to Cross Site Scripting (XSS)

Software Woocommerce Email Report Type Plugin Vulnerable versions = 2.4 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-27627 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 629859a93d95 Credits Yuki Haruma...

WordPress Direct checkout, Add to cart redirect for Woocommerce Plugin <= 2.1.48 is vulnerable to Cross Site Scripting (XSS)

Software Direct checkout, Add to cart redirect for Woocommerce Type Plugin Vulnerable versions = 2.1.48 Fixed in 2.1.49 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-28988 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID...

WordPress WooCommerce Multiple Customer Addresses & Shipping Plugin < 21.7 is vulnerable to Insecure Direct Object References (IDOR)

Software WooCommerce Multiple Customer Addresses & Shipping Type Plugin Vulnerable versions 21.7 Fixed in 21.7 OWASP Top 10 A5: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2023-0865 Patch priority Low CVSS severity Low 6.3 Developer Claim ownership PSID...

WordPress WooCommerce Checkout Field Manager Plugin < 18.0 is vulnerable to Arbitrary File Upload

Software WooCommerce Checkout Field Manager Type Plugin Vulnerable versions 18.0 Fixed in 18.0 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2022-4328 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 8dcb3ac5c4ef Credits cydave Required privilege...

WordPress WooVIP – Membership plugin for WordPress and WooCommerce Plugin <= 1.4.4 is vulnerable to Server Side Request Forgery (SSRF)

Software WooVIP – Membership plugin for WordPress and WooCommerce Type Plugin Vulnerable versions = 1.4.4 Fixed in N/A OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2022-40700 Patch priority Low CVSS severity Low 8.2 Developer Claim ownership PSID f21710078bd7...

WordPress WooCommerce Eway Gateway Plugin <= 3.5.0 is vulnerable to Insecure Direct Object References (IDOR)

Software WooCommerce Eway Gateway Type Plugin Vulnerable versions = 3.5.0 Fixed in 3.5.1 OWASP Top 10 A5: Broken Access Control Classification Insecure Direct Object References IDOR CVE N/A Patch priority Low CVSS severity Low 6.3 Developer Claim ownership PSID 9e6ef9dda0ad Credits WordfenceTeam...

WordPress WooCommerce Chained Products Plugin < 2.12.0 is vulnerable to Broken Access Control

Software WooCommerce Chained Products Type Plugin Vulnerable versions 2.12.0 Fixed in 2.12.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2022-4872 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID b129a8471653 Credits WPScan...

CVE-2022-0814

The Ubigeo de Perú para Woocommerce WordPress plugin before 3.6.4 does not properly sanitise and escape some parameters before using them in SQL statements via various AJAX actions, some of which are available to unauthenticated users, leading to SQL Injections...

WordPress Rearrange WooCommerce Products plugin <= 4.0.2 - SQL Injection (SQLi) vulnerability

SQL Injection SQLi vulnerability discovered by Dave Jong Patchstack in WordPress Rearrange WooCommerce Products plugin versions = 4.0.2. Solution Update the WordPress Rearrange WooCommerce Products plugin to the latest available version at least 4.0.3...

WordPress WooCommerce Quick Reports plugin <= 2.7.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress WooCommerce Quick Reports plugin versions = 2.7.1. Solution No patched version available...

WordPress WooCommerce to Zoho CRM plugin <= 1.2.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress WooCommerce to Zoho CRM plugin versions = 1.2.0. Solution No patched version available...

WordPress WooCommerce – Country Based Payments plugin <= 1.4 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress WooCommerce – Country Based Payments plugin versions = 1.4. Solution Update the WordPress WooCommerce – Country Based Payments plugin to the latest available version at least 1.4.1...

WordPress WooCommerce Checkout For Digital Goods plugin <= 3.6.3 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress WooCommerce Checkout For Digital Goods plugin versions = 3.6.3. Solution Update the WordPress WooCommerce Checkout For Digital Goods plugin to the latest available version at least 3.6.4...

WordPress Woocommerce Customers Order History plugin <= 5.2.0 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Woocommerce Customers Order History plugin versions = 5.2.0. Solution Update the WordPress Woocommerce Customers Order History plugin to the latest available version at least 5.2.1...

Discount Rules for WooCommerce Plugin for WordPress < 2.1.0 Multiple Vulnerabilities

The WordPress Discount Rules for WooCommerce Plugin installed on the remote host is affected by SQL injection and unauthenticated stored Cross-Site Scripting XSS vulnerabilities. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported...

WordPress WooCommerce Advanced Order Export 3.1.3 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Product: WordPress WooCommerce - Advanced Order Export plugin. Vendor Homepage: https://algolplus.com/plugins/downloads/advanced-order-export-for-woocommerce-pro/ Vulnerable Version: 3.1.3 Fixed Version: 3.1.4 CVE Number: CVE-2020-11727 Author...

WordPress WooCommerce Advanced Order Export 3.1.3 Cross Site Scripting

Title: Reflected XSS Product: WordPress WooCommerce - Advanced Order Export plugin. Vendor Homepage: https://algolplus.com/plugins/downloads/advanced-order-export-for-woocommerce-pro/ Vulnerable Version: 3.1.3 Fixed Version: 3.1.4 CVE Number: CVE-2020-11727 Author: Jack Misiura from The Missing...

WordPress WooCommerce CardGate Payment6 Gateway Authentication Bypass Vulnerability

WordPress WooCommerce is a flexible open source e-commerce solution built on WordPress. An authentication bypass vulnerability exists in WordPress WooCommerce CardGate Payment6 Gateway, which can be exploited by an attacker to bypass the authentication mechanism and gain unauthorized access,...

WordPress WooCommerce CardGate Payment Gateway 3.1.15 Plugin - Payment Process Bypass Exploit

Exploit for php platform in category web applications Exploit Title: WordPress Plugin WooCommerce CardGate Payment Gateway 3.1.15 - Payment Process Bypass Exploit Author: GeekHack Vendor Homepage: https://www.cardgate.com www.curopayments.com Software Link:...

Finale WooCommerce Sale Countdown <= 2.9.0 - Arbitrary File Upload

The Finale Lite – Sales Countdown Timer & Discount for WooCommerce WordPress plugin was affected by an Arbitrary File Upload security vulnerability...