WordPress WPC Smart Messages for WooCommerce Plugin <= 4.2.1 is vulnerable to Local File Inclusion

Software WPC Smart Messages for WooCommerce Type Plugin Vulnerable versions = 4.2.1 Fixed in 4.2.2 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-10436 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 61988e9cc775 Credits theviper17y Required...

WordPress plugin WPC Smart Messages for WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-50416

Deserialization of Untrusted Data vulnerability in WPClever WPC Shop as a Customer for WooCommerce wpc-shop-as-customer allows Object Injection.This issue affects WPC Shop as a Customer for WooCommerce: from n/a through = 1.2.6...

CVE-2024-50416

Deserialization of Untrusted Data vulnerability in WPClever WPC Shop as a Customer for WooCommerce allows Object Injection.This issue affects WPC Shop as a Customer for WooCommerce: from n/a through 1.2.6...

CVE-2024-50416 WordPress WPC Shop as a Customer for WooCommerce plugin <= 1.2.6 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in WPClever WPC Shop as a Customer for WooCommerce wpc-shop-as-customer allows Object Injection.This issue affects WPC Shop as a Customer for WooCommerce: from n/a through = 1.2.6...

CVE-2024-50416

CVE-2024-50416 affects WordPress plugin WPC Shop as a Customer for WooCommerce (WPClever) up to version 1.2.6, describing a Deserialization of Untrusted Data leading to PHP Object Injection. Patchstack reports a fix in 1.2.7; the issue is triggered by object injection via deserialization of untru...

WordPress plugin WPC Shop as a Customer for WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress WPC Shop as a Customer for WooCommerce Plugin <= 1.2.6 is vulnerable to PHP Object Injection

Software WPC Shop as a Customer for WooCommerce Type Plugin Vulnerable versions = 1.2.6 Fixed in 1.2.7 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-50416 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID ffccd26940cf Credits LVT-tholv2k...

WordPress WPC Frequently Bought Together for WooCommerce Plugin <= 7.1.9 is vulnerable to Broken Access Control

Software WPC Frequently Bought Together for WooCommerce Type Plugin Vulnerable versions = 7.1.9 Fixed in 7.2.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-43312 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID db028982e3ce Credit...

CVE-2024-30537 WordPress WPC Badge Management for WooCommerce plugin <= 2.4.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in WPClever WPC Badge Management for WooCommerce.This issue affects WPC Badge Management for WooCommerce: from n/a through 2.4.0...

CVE-2024-30537 WordPress WPC Badge Management for WooCommerce plugin <= 2.4.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in WPClever WPC Badge Management for WooCommerce.This issue affects WPC Badge Management for WooCommerce: from n/a through 2.4.0...

CVE-2024-30537

CVE-2024-30537 concerns the WPC Badge Management for WooCommerce plugin (WordPress) with versions up to 2.4.0. Descriptions in connected sources identify a Missing Authorization / Broken Access Control vulnerability that could allow unauthorized access. Public references indicate the issue affect...

PT-2024-23466 · Wpclever · Wpc Badge Management For Woocommerce

Name of the Vulnerable Software and Affected Versions: WPC Badge Management for WooCommerce versions 2.4.0 and earlier Description: The issue is related to a Missing Authorization vulnerability in WPClever WPC Badge Management for WooCommerce. This vulnerability allows unauthorized access due to...

WordPress WPC Composite Products for WooCommerce plugin <= 7.2.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Krzysztof Zając in WordPress Plugin WPC Composite Products for WooCommerce versions = 7.2.7...

CVE-2024-2838

CVE-2024-2838 affects WPC Composite Products for WooCommerce (WordPress) up to version 7.2.7, enabling Stored Cross-Site Scripting via the wooco_components[0][name] parameter due to insufficient input sanitization/output escaping and missing authorization on ajax_save_components. The vulnerabilit...

CVE-2024-2838 WPC Composite Products for WooCommerce <= 7.2.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting

The WPC Composite Products for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'woococomponents0name' parameter in all versions up to, and including, 7.2.7 due to insufficient input sanitization and output escaping and missing authorization on the...

WordPress plugin WPC Composite Products for WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-22403 · WordPress · Wpc Composite Products

Name of the Vulnerable Software and Affected Versions: WPC Composite Products for WooCommerce plugin for WordPress versions up to, and including, 7.2.7 Description: The issue arises from insufficient input sanitization and output escaping, along with missing authorization on the ajax save...

WPC Composite Products for WooCommerce < 7.2.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting

Description The WPC Composite Products for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'woococomponents0name' parameter in all versions up to, and including, 7.2.7 due to insufficient input sanitization and output escaping and missing authorization on the...

WPC Grouped Product for WooCommerce < 4.4.3 - Missing Authorization

Description The WPC Grouped Product for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the ajaxupdatesearchsettings, ajaxgetplugins, and ajaxgetessentialkit functions in all versions up to, and including, 4.4.2. This makes it possible fo...