Woo Shipping Dpd Baltic Vulnerabilities

The DPD Baltic Shipping plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search_value' parameter in all versions up to, and including, 1.2.83 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in p...

CVSS:

6.1

Affected:

up to 1.2.83

Fixed in:

1.2.84

Disclosed:

Oct 17, 2024

CVE-2024-9350 on NVD →

The WooCommerce Shipping – DPD baltic plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the delete_warehouse AJAX action in versions up to, and including, 1.2.54. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to delete ar...

CVSS:

5.4

Affected:

up to 1.2.56

Fixed in:

1.2.57

Disclosed:

Nov 21, 2022

CVE-2022-3999 on NVD →

The DPD Baltic Shipping plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shipping terminal parameters (ex: 'wc_shipping_(idnumber)_terminal') in versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping. This makes it possible for administrator-level attack...

CVSS:

5.5

Affected:

up to 1.2.8

Fixed in:

1.2.11

Disclosed:

Nov 16, 2022

CVE-2022-4000 on NVD →