Eu Vat For Woocommerce Vulnerabilities

Several plugins for WordPress by wpcodefactory are vulnerable to Stored Cross-Site Scripting in various versions due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will exe...

CVSS:

6.4

Affected:

up to 4.4.2

Fixed in:

4.4.3

Disclosed:

May 7, 2025

CVE-2025-47504 on NVD →

The EU/UK VAT Manager for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.12.11. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...

CVSS:

6.1

Affected:

up to 2.12.12

Fixed in:

2.12.14

Disclosed:

Sep 27, 2024

CVE-2024-8788 on NVD →

The EU/UK VAT Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the alg_wc_eu_vat_exempt_vat_from_admin() function in all versions up to, and including, 2.12.12. This makes it possible for unauthenticated attackers to update the VAT stat...

CVSS:

5.3

Affected:

up to 2.12.12

Fixed in:

2.12.14

Disclosed:

Sep 27, 2024

CVE-2024-9189 on NVD →

The EU/UK VAT Manager for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 2.12.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute...

CVSS:

6.1

Affected:

up to 2.12.14

Fixed in:

3.0.0

Disclosed:

Aug 29, 2024

CVE-2024-44061 on NVD →