CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-37554 – WordPress UltraAddons plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerability
https://notcve.org/view.php?id=CVE-2024-37554
06 Jul 2024 — Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CodeAstrology Team UltraAddons Elementor Lite (Header & Footer Builder, Menu Builder, Cart Icon, Shortcode).This issue affects UltraAddons Elementor Lite (Header & Footer Builder, Menu Builder, Cart Icon, Shortcode): from n/a through 1.1.6. Vulnerabilidad de neutralización incorrecta de la entrada durante la generación de páginas web (XSS o 'Cross-site Scripting') en CodeAstrology Team UltraAddons El... • https://patchstack.com/database/vulnerability/ultraaddons-elementor-lite/wordpress-ultraaddons-elementor-addons-header-footer-builder-custom-font-custom-css-woo-widget-menu-builder-anywhere-elementor-shortcode-plugin-1-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-49153 – WordPress Add to Cart Text Changer and Customize Button, Add Custom Icon Plugin <= 2.0 is vulnerable to Cross Site Request Forgery (CSRF)
https://notcve.org/view.php?id=CVE-2023-49153
28 Nov 2023 — Cross-Site Request Forgery (CSRF) vulnerability in Saiful Islam Add to Cart Text Changer and Customize Button, Add Custom Icon.This issue affects Add to Cart Text Changer and Customize Button, Add Custom Icon: from n/a through 2.0. Vulnerabilidad de Cross-Site Request Forgery (CSRF) en Saiful Islam Add to Cart Text Changer and Customize Button, Add Custom Icon. Este problema afecta a Add to Cart Text Changer and Customize Button, Add Custom Icon: desde n/a hasta 2.0. The Add to Cart Text Changer and Customi... • https://patchstack.com/database/vulnerability/woo-add-to-cart-text-change/wordpress-add-to-cart-text-changer-and-customize-button-add-custom-icon-plugin-2-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-48768 – WordPress Quantity Plus Minus Button for WooCommerce by CodeAstrology Plugin <= 1.1.9 is vulnerable to Cross Site Request Forgery (CSRF)
https://notcve.org/view.php?id=CVE-2023-48768
28 Nov 2023 — Cross-Site Request Forgery (CSRF) vulnerability in CodeAstrology Team Quantity Plus Minus Button for WooCommerce by CodeAstrology.This issue affects Quantity Plus Minus Button for WooCommerce by CodeAstrology: from n/a through 1.1.9. Vulnerabilidad de Cross-Site Request Forgery (CSRF) en CodeAstrology Team Quantity Plus Minus Button para WooCommerce. Este problema afecta a Quantity Plus Minus Button for WooCommerce para WooCommerce desde n/a hasta 1.1.9. The Quantity Plus Minus Button for WooCommerce by Cod... • https://patchstack.com/database/vulnerability/wc-quantity-plus-minus-button/wordpress-quantity-plus-minus-button-for-woocommerce-by-codeastrology-plugin-1-1-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-4270 – Min Max Control < 4.6 - Reflected XSS
https://notcve.org/view.php?id=CVE-2023-4270
21 Aug 2023 — The Min Max Control WordPress plugin before 4.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. El complemento de WordPress Min Max Control anterior a 4.6 no sanitiza ni escapa un parámetro antes de devolverlo a la página, conduciendo a un Cross-Site Scripting Reflejado que podría usarse contra usuarios con altos privilegios, como el administrador. The Min Max Control p... • https://wpscan.com/vulnerability/04560bf1-676b-46fb-9344-4150862f2686 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 3%CPEs: 1EXPL: 1CVE-2022-1020 – Woo Product Table < 3.1.2 - Unauthenticated Arbitrary Function Call
https://notcve.org/view.php?id=CVE-2022-1020
22 Mar 2022 — The Product Table for WooCommerce (wooproducttable) WordPress plugin before 3.1.2 does not have authorisation and CSRF checks in the wpt_admin_update_notice_option AJAX action (available to both unauthenticated and authenticated users), as well as does not validate the callback parameter, allowing unauthenticated attackers to call arbitrary functions with either none or one user controlled argument El plugin Product Table for WooCommerce (wooproducttable) de WordPress versiones anteriores a 3.1.2, no presen... • https://wpscan.com/vulnerability/04fe89b3-8ad1-482f-a96d-759d1d3a0dd5 • CWE-352: Cross-Site Request Forgery (CSRF) CWE-862: Missing Authorization •