Woo Discount Rules Vulnerabilities

The Discount Rules for WooCommerce – Create Smart WooCommerce Coupons & Discounts, Bulk Discount, BOGO Coupons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.6.5. This makes it possible...

CVSS:

4.7

Affected:

up to 2.6.5

Fixed in:

2.6.6

Disclosed:

Oct 15, 2024

CVE-2024-8541 on NVD →

The Discount Rules for WooCommerce WordPress plugin before 2.4.2 does not escape a parameter before outputting it back in an attribute of the plugin's discount rule page, leading to Reflected Cross-Site Scripting

CVSS:

6.1

Affected:

up to 2.4.1

Fixed in:

2.4.2

Disclosed:

Jun 27, 2022

CVE-2022-2090 on NVD →

The Discount Rules for WooCommerce plugin for WordPress is vulnerable to missing authorization via several AJAX actions in versions up to, and including, 2.2.0 due to missing capability checks on various functions. This makes it possible for subscriber-level attackers to execute various actions and perform a wide varie...

CVSS:

6.3

Affected:

up to 2.2.0

Fixed in:

2.2.1

Disclosed:

Sep 17, 2020

The Discount Rules for WooCommerce plugin for WordPress is vulnerable to missing authorization via several AJAX actions in versions up to, and including, 2.0.2 due to missing capability checks on various functions. This makes it possible for subscriber-level attackers to execute various actions and perform a wide varie...

CVSS:

6.3

Affected:

up to 2.0.2

Fixed in:

2.1.0

Disclosed:

Aug 20, 2020

CVE-2020-36834 on NVD →