Order Xml File Export Import For Woocommerce Vulnerabilities

The users-customers-import-export-for-wp-woocommerce plugin (and other Webtoffee plugins) before 1.3.9 for WordPress allows subscribers to import administrative accounts via CSV.

CVSS:

8.8

Affected:

up to 1.3.1

Fixed in:

1.3.1

Disclosed:

Mar 11, 2020

CVE-2020-12074 on NVD →

Cross-Site Request Forgery (CSRF) vulnerability discovered by WordFence in WordPress Order XML File Export Import for WooCommerce plugin (versions <= 1.3.0).

Affected:

up to 1.3.9

Fixed in:

1.3.9

Disclosed:

Mar 11, 2020

Cross-Site Scripting (XSS) vulnerability found in WordPress Order XML File Export Import for WooCommerce plugin (versions <= 1.2.2).

Affected:

up to 1.2.3

Fixed in:

1.2.3

Disclosed:

Aug 1, 2019

The Order XML File Export Import for WooCommerce Plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameters in versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web sc...

CVSS:

6.1

Affected:

up to 1.2.3

Fixed in:

1.2.3

Disclosed:

Dec 28, 2018

The Order XML File Export Import for WooCommerce Plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameters in versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web sc...

Affected:

up to 1.2.3

Fixed in:

1.2.3

Disclosed:

Dec 28, 2018

The Order XML File Export Import for WooCommerce WordPress plugin was affected by a XSS security vulnerability.

Affected:

up to 1.2.3

Fixed in:

1.2.3