Side Cart Woocommerce Vulnerabilities

Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the 'import_settings' function in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary optio...

CVSS:

8.8

Affected:

2.5 – 2.5

Fixed in:

2.5.1

Disclosed:

Jun 5, 2024

CVE-2024-5324 on NVD →

[en] Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in XootiX Side Cart Woocommerce (Ajax) plugin <= 2.2 versions.

Affected:

up to 2.3

Fixed in:

2.3

Disclosed:

Aug 30, 2023

CVE-2023-28415 on NVD →

The Side Cart Woocommerce (Ajax) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to i...

CVSS:

4.4

Affected:

up to 2.2

Fixed in:

2.3

Disclosed:

Jun 28, 2023

CVE-2023-28415 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in XootiX Side Cart Woocommerce (Ajax) < 2.1 versions.

Affected:

up to 2.2

Fixed in:

2.2

Disclosed:

May 22, 2023

CVE-2022-45376 on NVD →

The Side Cart Woocommerce (Ajax) plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions before 2.1. This is due to missing or incorrect nonce validation on one of its functions. This makes it possible for unauthenticated attackers to invoke this function and reset the plugin's settings, via forged...

CVSS:

5.4

Affected:

up to 2.1

Fixed in:

2.1

Disclosed:

Feb 2, 2023

CVE-2022-45376 on NVD →

[en] The Login/Signup Popup, Waitlist Woocommerce ( Back in stock notifier ), and Side Cart Woocommerce (Ajax) WordPress plugins by XootiX are vulnerable to Cross-Site Request Forgery via the save_settings function found in the ~/includes/xoo-framework/admin/class-xoo-admin-settings.php file which makes it possible for...

Affected:

up to 2.1

Fixed in:

2.1

Disclosed:

Jan 18, 2022

CVE-2022-0215 on NVD →

The Login/Signup Popup, Waitlist Woocommerce ( Back in stock notifier ), and Side Cart Woocommerce (Ajax) WordPress plugins by XootiX are vulnerable to Cross-Site Request Forgery via the save_settings function found in the ~/includes/xoo-framework/admin/class-xoo-admin-settings.php file which makes it possible for atta...

CVSS:

8.8

Affected:

up to 2.0

Fixed in:

2.1

Disclosed:

Jan 13, 2022

CVE-2022-0215 on NVD →