Primer Mydata Vulnerabilities

Reflected Cross-Site Scripting vulnerability

CVSS:

7.1

Affected:

up to 4.2.1

Fixed in:

4.2.2

Disclosed:

Mar 10, 2026

The Primer MyData for Woocommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.2.8. This makes it possible for unauthenticated attackers to perform actions on files outside of the originally intended directory.

CVSS:

5.3

Affected:

up to 4.2.8

Fixed in:

4.2.9

Disclosed:

Feb 9, 2026

CVE-2025-69325 on NVD →

The Primer MyData for Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.5. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action granted they can tric...

CVSS:

4.3

Affected:

up to 4.2.5

Fixed in:

4.2.6

Disclosed:

Aug 14, 2025

CVE-2025-53575 on NVD →

The Primer MyData for Woocommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to 4.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully t...

CVSS:

6.1

Affected:

up to 4.2.4

Fixed in:

4.2.4

Disclosed:

Mar 27, 2025

CVE-2025-30924 on NVD →

The Primer MyData for Woocommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'img_src' parameter in all versions up to, and including, 4.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts...

CVSS:

6.1

Affected:

up to 4.2.1

Fixed in:

4.2.2

Disclosed:

Dec 12, 2024

CVE-2024-11809 on NVD →