CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-9944 – WooCommerce <= 9.0.2 - Unauthenticated HTML Injection
https://notcve.org/view.php?id=CVE-2024-9944
The WooCommerce plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 9.0.2. This is due to the plugin not properly neutralizing HTML elements from submitted order forms. This makes it possible for unauthenticated attackers to inject arbitrary HTML that will render when the administrator views order form submissions. • https://github.com/woocommerce/woocommerce/pull/49370 https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3115837%40woocommerce%2Ftrunk&old=3106873%40woocommerce%2Ftrunk&sfp_email=&sfph_mail= https://raw.githubusercontent.com/woocommerce/woocommerce/trunk/changelog.txt https://www.wordfence.com/threat-intel/vulnerabilities/id/b5dfe2a5-612f-4e6c-a639-4afcff2ffa4c?source=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-34765 – WordPress Sensei Pro (WC Paid Courses) plugin <= 4.23.1.1.23.1 - Cross Site Scripting (XSS) vulnerability
https://notcve.org/view.php?id=CVE-2024-34765
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Sensei Sensei Pro (WC Paid Courses) allows Stored XSS.This issue affects Sensei Pro (WC Paid Courses): from n/a through 4.23.1.1.23.1. La vulnerabilidad de neutralización inadecuada de la entrada durante la generación de páginas web (XSS o 'Cross-site Scripting') en Sensei Sensei Pro (cursos pagos de WC) permite XSS Almacenado. Este problema afecta a Sensei Pro (cursos pagos de WC): desde n/a hasta 4.23. 1.1.23.1. The Sensei Pro (WC Paid Courses) plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.23.1.1.23.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Student-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://patchstack.com/database/vulnerability/woothemes-sensei/wordpress-sensei-pro-wc-paid-courses-plugin-4-23-1-1-23-1-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2015-2069 – WooCommerce <= 2.2.10 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2015-2069
Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.2.11 for WordPress allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING in the wc-reports page to wp-admin/admin.php. Vulnerabilidad de XSS en el plugin WooCommerce anterior a 2.2.11 para WordPress permite a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a través de QUERY_STRING en la página wc-reports en wp-admin/admin.php. • http://packetstormsecurity.com/files/130458/WordPress-WooCommerce-2.2.10-Cross-Site-Scripting.html http://seclists.org/fulldisclosure/2015/Feb/75 http://www.securityfocus.com/bid/74885 https://wordpress.org/plugins/woocommerce/changelog • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.3EPSS: 0%CPEs: 16EXPL: 1CVE-2014-6313 – WooCommerce <= 2.2.2 - Cross-Site Scripting via range Parameter
https://notcve.org/view.php?id=CVE-2014-6313
Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the range parameter on the wc-reports page to wp-admin/admin.php. Vulnerabilidad de XSS en el plugin WooCommerce anterior a 2.2.3 para WordPress permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro range en la página wc-reports en wp-admin/admin.php. • http://seclists.org/fulldisclosure/2014/Sep/59 http://secunia.com/advisories/61377 https://security.dxw.com/advisories/reflected-xss-in-woocommerce-excelling-ecommerce-allows-attackers-ability-to-do-almost-anything-an-admin-user-can-do https://wordpress.org/plugins/woocommerce/changelog • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •