Woo Orders Tracking Vulnerabilities

The The Orders Tracking for WooCommerce plugin for WordPress for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.2.10. This is due to the plugin allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possibl...

CVSS:

6.5

Affected:

up to 1.2.10

Fixed in:

1.2.11

Disclosed:

May 9, 2024

CVE-2024-4039 on NVD →

The Orders Tracking for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 1.2.5 via the 'file_url' parameter when importing CSV files. This allows authenticated attackers, with administrator-level (manage_woocommerce) privileges and above, to read the contents of th...

CVSS:

2.7

Affected:

up to 1.2.5

Fixed in:

1.2.6

Disclosed:

Aug 14, 2023

CVE-2023-4216 on NVD →

The Orders Tracking for WooCommerce WordPress plugin before 1.1.10 does not sanitise and escape the file_url before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting

CVSS:

6.1

Affected:

up to 1.0.14

Fixed in:

1.1.10

Disclosed:

Dec 27, 2021

CVE-2021-25062 on NVD →