Jigoshop Store Toolkit Vulnerabilities

The Jigoshop – Store Toolkit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can suc...

CVSS:

6.1

Affected:

up to 1.4.0

Fix:

No patched version reported

Disclosed:

Nov 4, 2024

CVE-2024-51712 on NVD →

The Jigoshop – Store Toolkit plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the 'jigo_st_admin_init' function in versions up to, and including 1.3.8. This makes it possible for unauthenticated attackers to gain access to restricted actions like deleting inactive user acc...

CVSS:

9.8

Affected:

up to 1.3.8

Fixed in:

1.3.9

Disclosed:

Feb 15, 2016