Elex Woocommerce Dynamic Pricing And Discounts Vulnerabilities

[en] The ELEX WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the elex_dp_export_rules() and elex_dp_import_rules() functions in all versions up to, and including, 2.1.7. This makes it possible for unauthenticated attackers...

Affected:

up to 2.1.8

Fixed in:

2.1.8

Disclosed:

Dec 24, 2024

CVE-2024-12266 on NVD →

The ELEX WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the elex_dp_export_rules() and elex_dp_import_rules() functions in all versions up to, and including, 2.1.7. This makes it possible for unauthenticated attackers to i...

CVSS:

6.5

Affected:

up to 2.1.7

Fixed in:

2.1.8

Disclosed:

Dec 23, 2024

CVE-2024-12266 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in ELEXtensions ELEX WooCommerce Dynamic Pricing and Discounts.This issue affects ELEX WooCommerce Dynamic Pricing and Discounts: from n/a through 2.1.2.

Affected:

up to 2.1.3

Fixed in:

2.1.3

Disclosed:

Apr 12, 2024

CVE-2024-31364 on NVD →

The ELEX WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1.2. This is due to missing or incorrect nonce validation on various function. This makes it possible for unauthenticated attackers to perform unauthorized actions via...

CVSS:

5.3

Affected:

up to 2.1.2

Fixed in:

2.1.3

Disclosed:

Apr 11, 2024

CVE-2024-32105 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in ELEXtensions ELEX WooCommerce Dynamic Pricing and Discounts.This issue affects ELEX WooCommerce Dynamic Pricing and Discounts: from n/a through 2.1.2.

Affected:

up to 2.1.3

Fixed in:

2.1.3

Disclosed:

Apr 11, 2024

CVE-2024-32105 on NVD →

The ELEX WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1.2. This is due to missing or incorrect nonce validation on various function. This makes it possible for unauthenticated attackers to perform unauthorized actions via...

CVSS:

4.3

Affected:

up to 2.1.2

Fixed in:

2.1.3

Disclosed:

Apr 8, 2024

CVE-2024-31364 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ELEXtensions ELEX WooCommerce Dynamic Pricing and Discounts allows Reflected XSS.This issue affects ELEX WooCommerce Dynamic Pricing and Discounts: from n/a through 2.1.2.

Affected:

up to 2.1.3

Fixed in:

2.1.3

Disclosed:

Apr 7, 2024

CVE-2024-31255 on NVD →

The ELEX WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via an unknown parameter in all versions up to, and including, 2.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...

CVSS:

6.1

Affected:

up to 2.1.2

Fixed in:

2.1.3

Disclosed:

Apr 5, 2024

CVE-2024-31255 on NVD →