Totalprocessing Card Payments Vulnerabilities

[en] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in totalprocessing Nomupay Payment Processing Gateway allows Path Traversal. This issue affects Nomupay Payment Processing Gateway: from n/a through 7.1.7.

Affected:

up to 7.1.7

Fix:

No patched version reported

Disclosed:

May 23, 2025

CVE-2025-46486 on NVD →

The Total processing card payments for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 7.1.7. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to download and read the contents of arbitrary files on the server, whic...

CVSS:

4.9

Affected:

up to 7.1.7

Fixed in:

7.1.8

Disclosed:

May 2, 2025

CVE-2025-46486 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in totalprocessing Nomupay Payment Processing Gateway allows Reflected XSS. This issue affects Nomupay Payment Processing Gateway: from n/a through 7.1.6.

Affected:

up to 7.1.7

Fixed in:

7.1.7

Disclosed:

Apr 17, 2025

CVE-2025-32513 on NVD →

The Nomupay Payment Processing Gateway plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 7.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if th...

CVSS:

6.1

Affected:

up to 7.1.6

Fixed in:

7.1.7

Disclosed:

Apr 14, 2025

CVE-2025-32513 on NVD →

[en] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in totalprocessing Total processing card payments for WooCommerce allows Path Traversal. This issue affects Total processing card payments for WooCommerce: from n/a through 7.1.5.

Affected:

up to 7.1.6

Fixed in:

7.1.6

Disclosed:

Apr 10, 2025

CVE-2025-32209 on NVD →

The Total processing card payments for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 7.1.5 via the ajax_download_debugdata_file() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to download the contents of arb...

CVSS:

8.1

Affected:

up to 7.1.5

Fixed in:

7.1.6

Disclosed:

Apr 7, 2025

CVE-2025-32209 on NVD →