CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 1CVE-2023-6625 – Product Enquiry for WooCommerce < 3.1 - Arbitrary Enquiry Deletion via CSRF
https://notcve.org/view.php?id=CVE-2023-6625
22 Jan 2024 — The Product Enquiry for WooCommerce WordPress plugin before 3.1 does not have a CSRF check in place when deleting inquiries, which could allow attackers to make a logged in admin delete them via a CSRF attack El complemento Product Inquiry for WooCommerce de WordPress anterior a 3.1 no tiene una verificación CSRF implementada al eliminar consultas, lo que podría permitir a los atacantes hacer que un administrador que haya iniciado sesión las elimine mediante un ataque CSRF. • https://wpscan.com/vulnerability/d483f7ce-cb3f-4fcb-b060-005cec0ea10f • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-6626 – Product Enquiry for WooCommerce < 3.1 - Admin+ Stored XSS
https://notcve.org/view.php?id=CVE-2023-6626
28 Dec 2023 — The Product Enquiry for WooCommerce WordPress plugin before 3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) El complemento Product Inquiry for WooCommerce de WordPress anterior a 3.1 no sanitiza ni escapa a algunas de sus configuraciones, lo que podría permitir a usuarios con privilegios elevados, como el administra... • https://wpscan.com/vulnerability/327ae124-79eb-4e07-b029-e4f543cbd356 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-49761 – WordPress Product Enquiry for WooCommerce Plugin <= 3.0 is vulnerable to Cross Site Request Forgery (CSRF)
https://notcve.org/view.php?id=CVE-2023-49761
04 Dec 2023 — Cross-Site Request Forgery (CSRF) vulnerability in Gravity Master Product Enquiry for WooCommerce.This issue affects Product Enquiry for WooCommerce: from n/a through 3.0. Vulnerabilidad de Cross-Site Request Forgery (CSRF) en Gravity Master Product Inquiry para WooCommerce. Este problema afecta a Product Inquiry para WooCommerce: desde n/a hasta 3.0. The Product Enquiry for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0. This is due to mis... • https://patchstack.com/database/vulnerability/gm-woocommerce-quote-popup/wordpress-product-enquiry-for-woocommerce-plugin-3-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-47696 – WordPress Product Enquiry for WooCommerce Plugin <= 3.0 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-47696
13 Nov 2023 — Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Gravity Master Product Enquiry for WooCommerce plugin <= 3.0 versions. Vulnerabilidad de Cross-Site Scripting (XSS) Almacenada No Autenticada en el complemento Gravity Master Product Enquiry para WooCommerce en versiones <= 3.0. Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Gravity Master Product Enquiry for WooCommerce plugin <= 3.0 versions. • https://patchstack.com/database/vulnerability/gm-woocommerce-quote-popup/wordpress-product-enquiry-for-woocommerce-plugin-3-0-cross-site-scripting-xss-vulnerability-2?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •