Flexible Shipping Vulnerabilities

The Flexible Shipping plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 4.24.15. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action

CVSS:

4.3

Affected:

up to 4.24.15

Fixed in:

4.24.16

Disclosed:

Apr 22, 2024

CVE-2024-32828 on NVD →

The Table Rate Shipping Method for WooCommerce by Flexible Shipping plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in versions up to, and including, 4.11.8. This makes it possible for unauthenticated attackers to inject arbitr...

CVSS:

6.1

Affected:

up to 4.11.8

Fixed in:

4.11.9

Disclosed:

Jun 14, 2022