CVE-2022-3999

Affected software: DPD Baltic Shipping WordPress plugin. Vulnerable: versions prior to 1.2.57, due to missing authorization and CSRF protection in an AJAX action. Impact: any authenticated user (e.g., subscriber) could delete arbitrary options, potentially rendering the blog unavailable. Remediat...

CVE-2022-4000

CVE-2022-4000 affects the WooCommerce Shipping WordPress plugin (versions up to 1.2.11). The issue is due to insufficient sanitisation/escaping of certain settings, enabling Stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disallowed, including multisite setups. Publ...