CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24323 – Woocommerce < 5.2.0 - Authenticated Stored Cross-Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2021-24323
When taxes are enabled, the "Additional tax classes" field was not properly sanitised or escaped before being output back in the admin dashboard, allowing high privilege users such as admin to use XSS payloads even when the unfiltered_html is disabled Cuando la opción taxes está habilitada, el campo "Additional tax classes" no es saneado apropiadamente antes de ser devuelto en el panel de administración, permitiendo a usuarios con altos privilegios, tales como el administrador, usar cargas útiles XSS incluso cuando el parámetro unfiltered_html está deshabilitado The WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Additional tax classes' field when the tax functionality of WooCommerce is enabled in versions up to, and including, 5.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative privileges to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. • https://wpscan.com/vulnerability/6d262555-7ae4-4e36-add6-4baa34dc3010 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24212 – WooCommerce Help Scout < 2.9.1 - Unauthenticated Arbitrary File Upload leading to RCE
https://notcve.org/view.php?id=CVE-2021-24212
The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allows unauthenticated users to upload any files to the site which by default will end up in wp-content/uploads/hstmp. El plugin del WordPress WooCommerce Help Scout, versiones anteriores a 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) permite a usuarios no autenticados cargar cualquier archivo en el sitio que, por defecto, terminará en wp-content/uploads/hstmp • http://dzv365zjfbd8v.cloudfront.net/changelogs/woocommerce-help-scout/changelog.txt https://wpscan.com/vulnerability/cf9305e8-f5bc-45c3-82db-0ef00fd46129 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-24171 – WooCommerce Upload Files < 59.4 - Unauthenticated Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2021-24171
The WooCommerce Upload Files WordPress plugin before 59.4 ran a single sanitization pass to remove blocked extensions such as .php. It was possible to bypass this and upload a file with a PHP extension by embedding a "blocked" extension within another "blocked" extension in the "wcuf_file_name" parameter. It was also possible to perform a double extension attack and upload files to a different location via path traversal using the "wcuf_current_upload_session_id" parameter. El plugin de WordPress WooCommerce Upload Files versiones anteriores a 59.4 ejecutó una sola pasada de saneamiento para eliminar extensiones bloqueadas como .php. Era posible omitir esto y cargar un archivo con una extensión PHP insertando una extensión "blocked" dentro de otra extensión "blocked" en el parámetro "wcuf_file_name". • https://wpscan.com/vulnerability/ed4288a1-f7e4-455f-b765-5ac343f87194 https://www.wordfence.com/blog/2021/03/critical-vulnerability-patched-in-woocommerce-upload-files • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2020-35627
https://notcve.org/view.php?id=CVE-2020-35627
Ultimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom GiftCard Template that can remotely execute arbitrary code. Once it contains the function "Custom Gift Card Template", the function of uploading a custom image is used, changing the name of the image extension to PHP and executing PHP code on the server. Ultimate WooCommerce Gift Cards versión 3.0.2, está afectada por una vulnerabilidad de carga de archivos en la Custom GiftCard Template que puede ejecutar remotamente código arbitrario. Una vez que contiene la función "Custom Gift Card Template", la función de cargar una imagen personalizada es usada, cambiando el nombre de la extensión de la imagen a PHP y ejecutando el código PHP en el servidor • https://gist.github.com/bc0d3/cbc458f0fcbe0f897e529c7f3d77c9d6 https://makewebbetter.com/product/giftware-woocommerce-gift-cards • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 2CVE-2020-11497 – NAB Transact < 2.1.2 - Payment System Bypass
https://notcve.org/view.php?id=CVE-2020-11497
An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. An online payment system bypass allows orders to be marked as fully paid by assigning an arbitrary bank transaction ID during the payment-details entry step. Se detectó un problema en la extensión NAB Transact versión 2.1.0, para el plugin WooCommerce para WordPress. Una omisión del sistema de pago en línea permite que los pedidos sean marcados como pagados en su totalidad mediante la asignación de una ID de transacción bancaria arbitraria durante el paso de entrada de los detalles del pago WordPress NAB Transact WooCommerce plugin version 2.1.0 suffers from a payment bypass vulnerability. • http://packetstormsecurity.com/files/158931/WordPress-NAB-Transact-WooCommerce-2.1.0-Payment-Bypass.html http://seclists.org/fulldisclosure/2020/Aug/13 https://www.themissinglink.com.au/security-advisories-cve-2020-11497 • CWE-354: Improper Validation of Integrity Check Value CWE-693: Protection Mechanism Failure •