WooCommerce Report <= 1.5.1 - Cross-Site Request Forgery to Arbitrary Options Update
high
The WooCommerce Report plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.1. This is due to missing or incorrect nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to update arbitrary options that can be lev...
- CVSS:
- 8.8
- Affected:
- up to 1.5.1
- Fixed in:
- 1.5.2
- Disclosed:
- Nov 4, 2024
CVE-2024-10711 on NVD →
WooCommerce Report <= 1.4.5 - Reflected Cross-Site Scripting
medium
The WooCommerce Report plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can succe...
- CVSS:
- 6.1
- Affected:
- up to 1.4.5
- Fixed in:
- 1.5.0
- Disclosed:
- Jul 10, 2024
CVE-2024-38683 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database