CVSS: 5.4EPSS: %CPEs: 1EXPL: 0CVE-2023-45101 – Customer Reviews for WooCommerce <= 5.36.0 - Missing Authorization in Reviews Exporter
https://notcve.org/view.php?id=CVE-2023-45101
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the check_progress and cancel_export functions in versions up to, and including, 5.36.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to check the progress of or cancel a reviews export. • CWE-862: Missing Authorization •
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2023-45072 – WordPress Order auto complete for WooCommerce Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-45072
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kardi Order auto complete for WooCommerce plugin <= 1.2.0 versions. Vulnerabilidad de Coss-Site Scripting (XSS) autenticada (con permisos de admin o superiores) almacenada en Kardi Order auto complete para WooCommerce en versiones <= 1.2.0. The Order auto complete for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://patchstack.com/database/vulnerability/order-auto-complete-for-woocommerce/wordpress-order-auto-complete-for-woocommerce-plugin-1-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-44149 – Brands for WooCommerce <= 3.8.2.2 - Missing Authorization to Unauthenticated Order Manipulation and Information Retrieval
https://notcve.org/view.php?id=CVE-2023-44149
The Brands for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.8.2.2. This is due to missing capability checks on the clear_cache_ajax, save_order, br_get_products, br_get_brands, and save_all_orders functions hooked via AJAX nopriv actions. This makes it possible for unauthenticated attackers to modify orders and clear the plugin's cache. Please note that while the plugin author only added nonces to the functions, and not capability checks, the nonces are not disclosed to unauthorized users making this issue patched, though not perfectly. • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-41803 – BitPay Checkout for WooCommerce <= 4.1.0 - Missing Authorization
https://notcve.org/view.php?id=CVE-2023-41803
The BitPay Checkout for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on an unknown function in versions up to, and including, 4.1.0. This makes it possible for unauthenticated attackers to perform an unauthorized action. • CWE-862: Missing Authorization •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-4703 – All in One B2B for WooCommerce <= 1.0.3 - Unauthenticated Privilege Escalation
https://notcve.org/view.php?id=CVE-2023-4703
The All in One B2B for WooCommerce WordPress plugin through 1.0.3 does not properly validate parameters when updating user details, allowing an unauthenticated attacker to update the details of any user. Updating the password of an Admin user leads to privilege escalation. El complemento de WordPress All in One B2B para WooCommerce hasta la versión 1.0.3 no valida correctamente los parámetros al actualizar los detalles del usuario, lo que permite a un atacante no autenticado actualizar los detalles de cualquier usuario. Actualizar la contraseña de un usuario Admin conduce a una escalada de privilegios. The All in One B2B for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.0.3. • https://wpscan.com/vulnerability/83278bbb-90e6-4465-a46d-60b4c703c11a • CWE-269: Improper Privilege Management •