CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2023-32575 – WordPress Product page shipping calculator for WooCommerce Plugin <= 1.3.25 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-32575
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PI Websolution Product page shipping calculator for WooCommerce plugin <= 1.3.25 versions. Vulnerabilidad de Cross-Site Scripting (XSS) Almacenada en Product page shipping calculator for WooCommerce de PI Websolution que afecta a las versiones 1.3.25 e inferiores. Para explotar esta vulnerabilidad hace falta estar autenticado y tener permisos de administrador o superior. The Product page shipping calculator for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.3.25 due to insufficient input sanitization and output escaping. • https://patchstack.com/database/vulnerability/product-page-shipping-calculator-for-woocommerce/wordpress-product-page-shipping-calculator-for-woocommerce-plugin-1-3-25-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-44633 – WordPress YITH WooCommerce Gift Cards Premium plugin <= 3.23.1 - Unauth. Gift Card Creation Leading to Stored XSS vulnerability
https://notcve.org/view.php?id=CVE-2022-44633
Missing Authorization vulnerability in YITH YITH WooCommerce Gift Cards Premium.This issue affects YITH WooCommerce Gift Cards Premium: from n/a through 3.23.1. Vulnerabilidad de autorización faltante en YITH YITH WooCommerce Gift Cards Premium. Este problema afecta a YITH WooCommerce Gift Cards Premium: desde n/a hasta 3.23.1. The YITH WooCommerce Gift Cards Premium plugin for WordPress is vulnerable to unauthorized gift card creation due to a missing capability check on one of its functions in versions up to, and including, 3.23.1. This makes it possible for unauthenticated attackers to create gift cards. • https://patchstack.com/database/vulnerability/yith-woocommerce-gift-cards-premium/wordpress-yith-woocommerce-gift-cards-premium-plugin-3-23-1-unauth-gift-card-creation-leading-to-stored-xss-vulnerability?_s_id=cve • CWE-862: Missing Authorization •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-27608 – WordPress Points and Rewards for WooCommerce plugin <= 1.5.0 - Broken Access Control vulnerability
https://notcve.org/view.php?id=CVE-2023-27608
Missing Authorization vulnerability in WP Swings Points and Rewards for WooCommerce.This issue affects Points and Rewards for WooCommerce: from n/a through 1.5.0. Vulnerabilidad de autorización faltante en WP Swings Points and Rewards para WooCommerce. Este problema afecta a Points and Rewards for WooCommerce: desde n/a hasta 1.5.0. The Points and Rewards for WooCommerce plugin for WordPress is vulnerable to missing authorization due to a missing capability check on the 'wps_wpr_points_update' function in versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to update reward points. • https://patchstack.com/database/vulnerability/points-and-rewards-for-woocommerce/wordpress-points-and-rewards-for-woocommerce-plugin-1-5-0-broken-access-control-vulnerability?_s_id=cve • CWE-862: Missing Authorization •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-27607 – WordPress Points and Rewards for WooCommerce plugin <= 1.5.0 - Settings Change vulnerability
https://notcve.org/view.php?id=CVE-2023-27607
Missing Authorization vulnerability in WP Swings Points and Rewards for WooCommerce.This issue affects Points and Rewards for WooCommerce: from n/a through 1.5.0. Vulnerabilidad de autorización faltante en WP Swings Points and Rewards para WooCommerce. Este problema afecta a Points and Rewards for WooCommerce: desde n/a hasta 1.5.0. The Points and Rewards for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.0. This is due to a missing nonce check on the wps_wpr_points_update function. • https://patchstack.com/database/vulnerability/points-and-rewards-for-woocommerce/wordpress-points-and-rewards-for-woocommerce-plugin-1-5-0-settings-change-vulnerability?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) CWE-862: Missing Authorization •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-2179 – WooCommerce Order Status Change Notifier <= 1.1.0 - Subscriber+ Arbitrary Order Status Update
https://notcve.org/view.php?id=CVE-2023-2179
The WooCommerce Order Status Change Notifier WordPress plugin through 1.1.0 does not have authorisation and CSRF when updating status orders via an AJAX action available to any authenticated users, which could allow low privilege users such as subscriber to update arbitrary order status, making them paid without actually paying for them for example The WooCommerce Order Status Change Notifier plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on an AJAX action in versions up to, and including, 1.1.0. This makes it possible for authenticated attackers with minimal permissions, such as a customer, to modify arbitrary order status and mark orders as paid, for example, when the order isn't actually paid for. • https://wpscan.com/vulnerability/fbc56973-4225-4f44-8c38-d488e57cd551 • CWE-862: Missing Authorization •