Woocommerce vulnerabilities, page 4

89 vulnerabilities

Known vulnerabilities in Woocommerce products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 48 products.

7.1HighCVE-2023-32801woocommerce · composite_products +1 moreWordPress WooCommerce Composite Products Plugin <= 8.7.5 is vulnerable to Cross Site Scripting (XSS)Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Composite Products plugin <= 8.7.5 versions.EPSS0.40%8.2HighCVE-2023-32795woocommerce · product add-ons +2 moreWordPress WooCommerce Product Add-ons Plugin <= 6.1.3 is vulnerable to PHP Object InjectionDeserialization of Untrusted Data vulnerability in WooCommerce Product Add-Ons.This issue affects Product Add-Ons: from n/a through 6.1.3.EPSS0.67%6.5MediumCVE-2023-32793woocommerce · woocommerce_pre-orders +1 moreWordPress WooCommerce Pre-Orders Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Pre-Orders plugin <= 2.0.0 versions.EPSS0.38%7.5HighCVE-2023-32747automattic · woocommerce_bookings +2 moreWordPress WooCommerce Bookings Plugin <= 1.15.78 is vulnerable to Insecure Direct Object References (IDOR)Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Bookings.This issue affects WooCommerce Bookings: from n/a through 1.15.78.EPSS0.45%6.5MediumCVE-2023-32746woocommerce · woocommerce_brands +1 moreWordPress WooCommerce Brands Plugin <= 1.6.45 is vulnerable to Cross Site Scripting (XSS)Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Brands plugin <= 1.6.45 versions.EPSS0.38%5.9MediumCVE-2023-32575pi websolution · product page shipping calculator for woocommerce +2 moreWordPress Product page shipping calculator for WooCommerce Plugin <= 1.3.25 is vulnerable to Cross Site Scripting (XSS)Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PI Websolution Product page shipping calculator for WooCommerce plugin <= 1.3.25 versions.EPSS0.40%7.2HighCVE-2023-32802woocommerce · woocommerce_pre-orders +1 moreWordPress WooCommerce Pre-Orders Plugin <= 1.9.0 is vulnerable to Cross Site Scripting (XSS)Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Pre-Orders plugin <= 1.9.0 versions.EPSS0.40%6.5MediumCVE-2023-32799woocommerce · shipping_multiple_addresses +1 moreWordPress WooCommerce Ship to Multiple Addresses Plugin <= 3.8.3 is vulnerable to Insecure Direct Object References (IDOR)Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce Shipping Multiple Addresses.This issue affects Shipping Multiple Addresses: from n/a through 3.8.3.EPSS0.55%8.8HighCVE-2023-32745woocommerce · automatewoo +1 moreWordPress AutomateWoo Plugin <= 5.7.1 is vulnerable to Cross Site Request Forgery (CSRF)Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce AutomateWoo plugin <= 5.7.1 versions.EPSS0.30%6.5MediumCVE-2023-3507unknown · woocommerce pre-orders +2 moreWooCommerce Pre-Orders < 2.0.3 - Arbitrary Pre-Order Canceling via CSRFThe WooCommerce Pre-Orders WordPress plugin before 2.0.3 has a flawed CSRF check when canceling pre-orders, which could allow attackers to make logged in admins cancel arbitrary pre-orders via a CSRF attackEPSS0.31%6.5MediumCVE-2023-3508unknown · woocommerce pre-orders +2 moreWooCommerce Pre-Orders < 2.0.3 - Unauthorised Actions via CSRFThe WooCommerce Pre-Orders WordPress plugin before 2.0.3 has a flawed CSRF check when processing its tab actions, which could allow attackers to make logged in admins email pre-orders customer, change the released date, mark all pre-orders of a specific product as complete or cancel via CSRF attacksEPSS0.31%6.5MediumCVE-2023-34003woo · woocommerce box office +2 moreWordPress WooCommerce Box Office plugin <= 1.1.51 - Unauthenticated Save Ticket Barcode vulnerabilityMissing Authorization vulnerability in Woo WooCommerce Box Office.This issue affects WooCommerce Box Office: from n/a through 1.1.51.EPSS0.35%7.5HighCVE-2023-34000woocommerce · stripe_payment_gateway +2 moreWordPress WooCommerce Stripe Payment Gateway Plugin <= 7.4.0 is vulnerable to Insecure Direct Object References (IDOR)Unauth. IDOR vulnerability leading to PII Disclosure in WooCommerce Stripe Payment Gateway plugin <= 7.4.0 versions.EPSS1.21%6.5MediumCVE-2023-34004woocommerce · woocommerce_box_office +1 moreWordPress WooCommerce Box Office Plugin <= 1.1.50 is vulnerable to Cross Site Scripting (XSS)Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Box Office plugin <= 1.1.50 versions.EPSS0.43%7.5HighCVE-2023-35914automattic · woocommerce_subscriptions +2 moreWordPress WooCommerce Subscriptions Plugin <= 5.1.2 is vulnerable to Insecure Direct Object References (IDOR)Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce Woo Subscriptions.This issue affects Woo Subscriptions: from n/a through 5.1.2.EPSS0.57%7.1HighCVE-2023-35918woocommerce · bulk_stock_management +1 moreWordPress WooCommerce Bulk Stock Management Plugin <= 2.2.33 is vulnerable to Cross Site Scripting (XSS)Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Bulk Stock Management plugin <= 2.2.33 versions.EPSS0.42%9.8CriticalCVE-2023-35879woo · product_vendors +2 moreWordPress WooCommerce Product Vendors Plugin <= 2.1.78 is vulnerable to SQL InjectionImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce Product Vendors allows SQL Injection.This issue affects Product Vendors: from n/a through 2.1.78.EPSS0.58%8.8HighCVE-2023-35917woocommerce · paypal_payments +2 moreWordPress WooCommerce PayPal Payments Plugin <= 2.0.4 is vulnerable to Cross Site Request Forgery (CSRF)Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce PayPal Payments plugin <= 2.0.4 versions.EPSS0.29%8.8HighCVE-2023-35881woocommerce · woocommerce one page checkout +1 moreWordPress WooCommerce One Page Checkout plugin <= 2.3.0 - Local File Inclusion vulnerabilityImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WooCommerce WooCommerce One Page Checkout allows PHP Local File Inclusion.This issue affects WooCommerce One Page Checkout: from n/a through 2.3.0.EPSS0.66%8.1HighCVE-2023-35876automattic · woocommerce_square +2 moreWordPress WooCommerce Square Plugin <= 3.8.1 is vulnerable to Insecure Direct Object References (IDOR)Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Square.This issue affects WooCommerce Square: from n/a through 3.8.1.EPSS0.83%