51 matches found
WordPress WP-Invoice plugin <= 4.3.1 - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF) vulnerability
Arbitrary Settings Update via Cross-Site Request Forgery CSRF vulnerability discovered by WPScanTeam in WordPress WP-Invoice plugin versions = 4.3.1. Solution No patched version is available...
WordPress WP-Invoice 4.3.1 Cross Site Scripting
Exploit Title: WordPress Plugin WP-Invoice - Stored Cross Site Scripting Date: 25-04-2022 Exploit Author: Mariam Tariq - HunterSherlock Vendor Homepage: https://wordpress.org/plugins/WP-Invoice/ Version: 4.3.1 Tested on: Firefox Contact me: [email protected] Vulnerable Code: wpi.businessna...
WordPress WP-Invoice 4.3.1 Cross Site Scripting Vulnerability
Exploit Title: WordPress Plugin WP-Invoice - Stored Cross Site Scripting Exploit Author: Mariam Tariq - HunterSherlock Vendor Homepage: https://wordpress.org/plugins/WP-Invoice/ Version: 4.3.1 Tested on: Firefox Contact me: email protected Vulnerable Code: wpi.businessname = ''; POC 1. Install th...
WP-Invoice <= 4.3.1 - Stored Cross-Site Scripting via CSRF
The plugin does not have CSRF check in place when updating its settings, and is lacking sanitisation as well as escaping in some of them, allowing attacker to make a logged in admin change them and add XSS payload in them ' /...
CVE-2016-11006
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admininit settings changes...
CVE-2016-11008
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpipaypal payer metadata updates...
CVE-2016-11006
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admininit settings changes...
CVE-2016-11011
The wp-invoice plugin before 4.1.1 for WordPress has wpiupdateuseroption privilege escalation...
CVE-2016-11010
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpitwocheckout payer metadata updates...
CVE-2016-11010
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpitwocheckout payer metadata updates...
CVE-2016-11008
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpipaypal payer metadata updates...
CVE-2016-11007
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpiuserid for invoice retrieval...
CVE-2016-11009
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpiinterkassa payer metadata updates...
Privilege escalation
The wp-invoice plugin before 4.1.1 for WordPress has wpiupdateuseroption privilege escalation...
Improper access control
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpiinterkassa payer metadata updates...
Improper access control
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpipaypal payer metadata updates...
Design/Logic Flaw
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpiuserid for invoice retrieval...
Design/Logic Flaw
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpitwocheckout payer metadata updates...
