CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2017-18356 – WooCommerce <= 3.2.3 - Authenticated PHP Object Injection
https://notcve.org/view.php?id=CVE-2017-18356
In the Automattic WooCommerce plugin before 3.2.4 for WordPress, an attack is possible after gaining access to the target site with a user account that has at least Shop manager privileges. The attacker then constructs a specifically crafted string that will turn into a PHP object injection involving the includes/shortcodes/class-wc-shortcode-products.php WC_Shortcode_Products::get_products() use of cached queries within shortcodes. En el plugin Automattic WooCommerce en versiones anteriores a la 3.2.4 para WordPress, es posible realizar un ataque tras obtener acceso al sitio objetivo con una cuenta de usuario que tiene, al menos, privilegios de gerente de tienda. El atacante construye una cadena especialmente manipulada que se convertirá en una inyección de objetos PHP relacionada con el uso de consultas en caché en códigos cortos en WC_Shortcode_Products::get_products(), en includes/shortcodes/class-wc-shortcode-products.php. • https://blog.ripstech.com/2018/woocommerce-php-object-injection https://woocommerce.wordpress.com/2017/11/16/woocommerce-3-2-4-security-fix-release-notes • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-10112 – WooCommerce <= 2.6.8 - Authenticated Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2016-10112
Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.6.9 for WordPress allows remote authenticated administrators to inject arbitrary web script or HTML by providing crafted tax-rate table values in CSV format. Vulnerabilidad de XSS en el plugin WooCommerce en versiones anteriores a 2.6.9 para WordPress permite a administradores remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios proporcionando valores de tabla tax-rate manipulados en formato CSV. • http://www.securityfocus.com/bid/95292 https://wordpress.org/plugins/woocommerce/changelog • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2015-2329 – WooCommerce <= 2.3.5 - Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2015-2329
Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.3.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via a crafted order. Una vulnerabilidad de tipo Cross-Site Scripting (XSS) en el plugin WooCommerce en versiones anteriores a la 2.3.6 para WordPress permite que los atacantes remotos inyecten scripts web o HTML arbitrarios mediante un pedido manipulado. • https://fortiguard.com/zeroday/FG-VD-15-020 https://raw.githubusercontent.com/woocommerce/woocommerce/master/CHANGELOG.txt • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2015-2069 – WooCommerce <= 2.2.10 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2015-2069
Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.2.11 for WordPress allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING in the wc-reports page to wp-admin/admin.php. Vulnerabilidad de XSS en el plugin WooCommerce anterior a 2.2.11 para WordPress permite a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a través de QUERY_STRING en la página wc-reports en wp-admin/admin.php. • http://packetstormsecurity.com/files/130458/WordPress-WooCommerce-2.2.10-Cross-Site-Scripting.html http://seclists.org/fulldisclosure/2015/Feb/75 http://www.securityfocus.com/bid/74885 https://wordpress.org/plugins/woocommerce/changelog • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •