CVE-2024-9356

The Yotpo: Product & Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'yotpouseremail' and 'yotpousername' parameters in all versions up to, and including, 1.7.9 due to insufficient input sanitization and output escaping. This makes it...

CVE-2024-9356

The CVE CVE-2024-9356 affects the Yotpo: Product & Photo Reviews for WooCommerce WordPress plugin. It enables Reflected Cross-Site Scripting via the yotpo_user_email and yotpo_user_name parameters in all versions up to and including 1.7.8 due to insufficient input sanitization and output escaping...

CVE-2024-9356 Yotpo: Product & Photo Reviews for WooCommerce <= 1.7.9 - Reflected Cross-Site Scripting

The Yotpo: Product & Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'yotpouseremail' and 'yotpousername' parameters in all versions up to, and including, 1.7.9 due to insufficient input sanitization and output escaping. This makes it...

CVE-2024-9356 Yotpo: Product & Photo Reviews for WooCommerce <= 1.7.8 - Reflected Cross-Site Scripting

The Yotpo: Product & Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'yotpouseremail' and 'yotpousername' parameters in all versions up to, and including, 1.7.8 due to insufficient input sanitization and output escaping. This makes it...

Cross site request forgery (csrf)

The Yotpo Reviews for WooCommerce WordPress plugin through 2.0.4 lacks nonce check when updating its settings, which could allow attacker to make a logged in admin change them via a CSRF attack...

CVE-2022-2555

The CVE-2022-2555 entry concerns the Yotpo Reviews for WooCommerce WordPress plugin (versions 2.0.4 and earlier). The root cause is missing nonce validation when updating plugin settings, enabling CSRF where a logged-in admin could change settings. Impact is unauthorized configuration changes; ex...

WordPress Yotpo Reviews for WooCommerce (Unofficial) plugin <= 2.0.4 - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF) vulnerability

Arbitrary Settings Update via Cross-Site Request Forgery CSRF vulnerability discovered by Johannes Gangsö in WordPress Yotpo Reviews for WooCommerce Unofficial plugin versions = 2.0.4. Solution Deactivate and delete. This plugin has been closed as of July 27, 2022 and is not available for downloa...