CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2025-30857 – WordPress Currency Switcher for WooCommerce plugin <= 0.0.7 - CSRF to Stored XSS vulnerability
https://notcve.org/view.php?id=CVE-2025-30857
27 Mar 2025 — Cross-Site Request Forgery (CSRF) vulnerability in PressMaximum Currency Switcher for WooCommerce allows Stored XSS. This issue affects Currency Switcher for WooCommerce: from n/a through 0.0.7. The Currency Switcher for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.0.7. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action granted they c... • https://patchstack.com/database/wordpress/plugin/currency-switcher-for-woocommerce/vulnerability/wordpress-currency-switcher-for-woocommerce-plugin-0-0-7-csrf-to-stored-xss-vulnerability?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-9217 – Currency Switcher for WooCommerce <= 2.16.2 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2024-9217
28 Feb 2025 — The Currency Switcher for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.16.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. • https://plugins.trac.wordpress.org/browser/currency-switcher-woocommerce/trunk/includes/functions/alg-switcher-selector-functions.php#L139 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-18668 – Currency Switcher <= 2.11.1 - Authorization Bypass
https://notcve.org/view.php?id=CVE-2019-18668
02 Nov 2019 — An issue was discovered in the Currency Switcher addon before 2.11.2 for WooCommerce if a user provides a currency that was not added by the administrator. In this case, even though the currency does not exist, it will be selected, but a price amount will fall back to the default currency. This means that if an attacker provides a currency that does not exist and is worth less than this default, the attacker can eventually purchase an item for a significantly cheaper price. Se detectó un problema en el addo... • https://wordpress.org/plugins/currency-switcher-woocommerce/#developers • CWE-755: Improper Handling of Exceptional Conditions CWE-862: Missing Authorization •