CVE-2024-5324

The Login/Signup Popup (Inline Form + Woocommerce) WordPress plugin is vulnerable to unauthorized data modification in versions 2.7.1 through 2.7.2 . The root cause is a missing capability check on the import_settings function, which allows authenticated attackers with Subscriber-level access and...

CVE-2022-0215

The CVE-2022-0215 issue affects three WordPress plugins by XootiX: Login/Signup Popup, Side Cart Woocommerce, and Waitlist Woocommerce. Root cause is a Cross-Site Request Forgery (CSRF) vulnerability in the save_settings function within ~/includes/xoo-framework/admin/class-xoo-admin-settings.php,...

CVE-2024-8724

CVE-2024-8724 affects the WordPress Waitlist Woocommerce (Back in stock notifier) plugin. A reflected XSS exists in all versions up to 2.7.5 due to improper escaping when constructing URLs with add_query_arg, enabling unauthenticated attackers to inject scripts if a user clicks a manipulated link...