CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 1CVE-2024-3964 – Product Enquiry for WooCommerce < 3.1.8 - Admin+ Stored XSS
https://notcve.org/view.php?id=CVE-2024-3964
22 Jun 2024 — The Product Enquiry for WooCommerce WordPress plugin before 3.1.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) El complemento Product Inquiry for WooCommerce WordPress anterior a 3.1.8 no sanitiza ni escapa a algunas de sus configuraciones, lo que podría permitir a usuarios con altos privilegios, como el administrado... • https://wpscan.com/vulnerability/ff468772-3e6a-439c-a4d7-94bd2ce1a964 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 1CVE-2023-6625 – Product Enquiry for WooCommerce < 3.1 - Arbitrary Enquiry Deletion via CSRF
https://notcve.org/view.php?id=CVE-2023-6625
22 Jan 2024 — The Product Enquiry for WooCommerce WordPress plugin before 3.1 does not have a CSRF check in place when deleting inquiries, which could allow attackers to make a logged in admin delete them via a CSRF attack El complemento Product Inquiry for WooCommerce de WordPress anterior a 3.1 no tiene una verificación CSRF implementada al eliminar consultas, lo que podría permitir a los atacantes hacer que un administrador que haya iniciado sesión las elimine mediante un ataque CSRF. • https://wpscan.com/vulnerability/d483f7ce-cb3f-4fcb-b060-005cec0ea10f • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-7151 – Product Enquiry for WooCommerce < 3.2 - Reflected XSS
https://notcve.org/view.php?id=CVE-2023-7151
15 Jan 2024 — The Product Enquiry for WooCommerce WordPress plugin before 3.2 does not sanitise and escape the page parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin El complemento Product Enquiry for WooCommerce para WordPress anterior a 3.2 no sanitiza ni escapa el parámetro page antes de devolverlo en un atributo, lo que genera cross site scripting reflejado que podría usarse contra usuarios con privilegios el... • https://wpscan.com/vulnerability/4992a4a9-f21a-46e2-babf-954acfc7c5b4 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-6626 – Product Enquiry for WooCommerce < 3.1 - Admin+ Stored XSS
https://notcve.org/view.php?id=CVE-2023-6626
28 Dec 2023 — The Product Enquiry for WooCommerce WordPress plugin before 3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) El complemento Product Inquiry for WooCommerce de WordPress anterior a 3.1 no sanitiza ni escapa a algunas de sus configuraciones, lo que podría permitir a usuarios con privilegios elevados, como el administra... • https://wpscan.com/vulnerability/327ae124-79eb-4e07-b029-e4f543cbd356 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-49761 – WordPress Product Enquiry for WooCommerce Plugin <= 3.0 is vulnerable to Cross Site Request Forgery (CSRF)
https://notcve.org/view.php?id=CVE-2023-49761
04 Dec 2023 — Cross-Site Request Forgery (CSRF) vulnerability in Gravity Master Product Enquiry for WooCommerce.This issue affects Product Enquiry for WooCommerce: from n/a through 3.0. Vulnerabilidad de Cross-Site Request Forgery (CSRF) en Gravity Master Product Inquiry para WooCommerce. Este problema afecta a Product Inquiry para WooCommerce: desde n/a hasta 3.0. The Product Enquiry for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0. This is due to mis... • https://patchstack.com/database/vulnerability/gm-woocommerce-quote-popup/wordpress-product-enquiry-for-woocommerce-plugin-3-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-47696 – WordPress Product Enquiry for WooCommerce Plugin <= 3.0 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-47696
13 Nov 2023 — Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Gravity Master Product Enquiry for WooCommerce plugin <= 3.0 versions. Vulnerabilidad de Cross-Site Scripting (XSS) Almacenada No Autenticada en el complemento Gravity Master Product Enquiry para WooCommerce en versiones <= 3.0. Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Gravity Master Product Enquiry for WooCommerce plugin <= 3.0 versions. • https://patchstack.com/database/vulnerability/gm-woocommerce-quote-popup/wordpress-product-enquiry-for-woocommerce-plugin-3-0-cross-site-scripting-xss-vulnerability-2?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-47512 – WordPress Product Enquiry for WooCommerce Plugin <= 3.0 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-47512
07 Nov 2023 — Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Gravity Master Product Enquiry for WooCommerce plugin <= 3.0 versions. Vulnerabilidad de Cross-Site Scripting (XSS) Reflejada No Autenticada en el complemento WooCommerce de Gravity Master Product Enquiry versiones <=3.0. The Product Enquiry for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in versions up to, and including, 3.0 due to insufficient input sanitization and output escaping. ... • https://patchstack.com/database/vulnerability/gm-woocommerce-quote-popup/wordpress-product-enquiry-for-woocommerce-plugin-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2023-29170 – WordPress Product Enquiry for WooCommerce Plugin <= 2.2.12 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-29170
03 Apr 2023 — Auth. (admin+) Stored Cross-site Scripting (XSS) vulnerability in PI Websolution Product Enquiry for WooCommerce, WooCommerce product catalog plugin <= 2.2.12 versions. The Product Enquiry for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 2.2.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers , with administrator-level access and above, to inject arbitrary web s... • https://patchstack.com/database/vulnerability/enquiry-quotation-for-woocommerce/wordpress-product-enquiry-for-woocommerce-plugin-2-2-12-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •