51 matches found
WordPress WP-Invoice plugin <= 4.3.1 - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF) vulnerability
Arbitrary Settings Update via Cross-Site Request Forgery CSRF vulnerability discovered by WPScanTeam in WordPress WP-Invoice plugin versions = 4.3.1. Solution No patched version is available...
WordPress WP-Invoice 4.3.1 Cross Site Scripting
Exploit Title: WordPress Plugin WP-Invoice - Stored Cross Site Scripting Date: 25-04-2022 Exploit Author: Mariam Tariq - HunterSherlock Vendor Homepage: https://wordpress.org/plugins/WP-Invoice/ Version: 4.3.1 Tested on: Firefox Contact me: [email protected] Vulnerable Code: wpi.businessna...
WordPress WP-Invoice 4.3.1 Cross Site Scripting Vulnerability
Exploit Title: WordPress Plugin WP-Invoice - Stored Cross Site Scripting Exploit Author: Mariam Tariq - HunterSherlock Vendor Homepage: https://wordpress.org/plugins/WP-Invoice/ Version: 4.3.1 Tested on: Firefox Contact me: email protected Vulnerable Code: wpi.businessname = ''; POC 1. Install th...
WP-Invoice <= 4.3.1 - Stored Cross-Site Scripting via CSRF
The plugin does not have CSRF check in place when updating its settings, and is lacking sanitisation as well as escaping in some of them, allowing attacker to make a logged in admin change them and add XSS payload in them ' /...
CVE-2016-11006
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admininit settings changes...
CVE-2016-11008
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpipaypal payer metadata updates...
CVE-2016-11010
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpitwocheckout payer metadata updates...
CVE-2016-11011
The wp-invoice plugin before 4.1.1 for WordPress has wpiupdateuseroption privilege escalation...
CVE-2016-11010
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpitwocheckout payer metadata updates...
CVE-2016-11006
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admininit settings changes...
CVE-2016-11008
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpipaypal payer metadata updates...
CVE-2016-11007
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpiuserid for invoice retrieval...
CVE-2016-11009
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpiinterkassa payer metadata updates...
Privilege escalation
The wp-invoice plugin before 4.1.1 for WordPress has wpiupdateuseroption privilege escalation...
Improper access control
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpiinterkassa payer metadata updates...
Improper access control
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpipaypal payer metadata updates...
Design/Logic Flaw
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpiuserid for invoice retrieval...
Design/Logic Flaw
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admininit settings changes...
Design/Logic Flaw
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpitwocheckout payer metadata updates...
CVE-2016-11011
The CVE-2016-11011 entry concerns the WordPress plugin WP-Invoice prior to version 4.1.1, which is affected by a privilege-escalation vulnerability in the wpi_update_user_option component. The issue enables elevated privileges within the plugin, as described across multiple sources (NVD entry ref...