Tipsandtricks Hq Wp Estore vulnerabilities
8 vulnerabilities
Known vulnerabilities in Tipsandtricks Hq Wp Estore, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2024-6133tipsandtricks-hqwp_estore+2
EPSS score0.45%
The wp-cart-for-digital-products WordPress plugin before 8.5.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as adminCVE-2024-6073tipsandtricks-hqwp_estore+2EPSS score0.32%
The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as adminCVE-2024-6076tipsandtricks-hqwp_estore+2EPSS score0.42%
The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as adminCVE-2024-6136tipsandtricks-hqwp_estore+2EPSS score0.23%
The wp-cart-for-digital-products WordPress plugin before 8.5.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacksCVE-2024-6074tipsandtricks-hqwp_estore+2EPSS score0.34%
The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as adminCVE-2024-6134tipsandtricks-hqwp_estore+2EPSS score0.40%
The wp-cart-for-digital-products WordPress plugin before 8.5.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as adminCVE-2024-6075tipsandtricks-hqwp_estore+2EPSS score0.37%
The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacksCVE-2024-6072tipsandtricks-hqwp_estore+2EPSS score0.33%
The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers