Extra Product Options For Woocommerce Vulnerabilities

The Extra Product Options for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the epofw_get_data_based_on_cd and epofw_change_field_basedon_type() functions in versions up to, and including, 3.0.6. This makes it possible for authenticated attacker...

CVSS:

4.3

Affected:

up to 3.0.6

Fixed in:

3.0.7

Disclosed:

Jun 6, 2024

CVE-2024-35727 on NVD →

The Extra Product Options for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in versions up to, and including, 4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with shop manager-level access and abo...

CVSS:

5.5

Affected:

up to 4.1

Fixed in:

4.2

Disclosed:

Nov 7, 2023

CVE-2023-47658 on NVD →