Woocommerce Box Office Vulnerabilities

The WooCommerce Box Office plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.2.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 1.2.2

Fixed in:

1.2.3

Disclosed:

Jan 31, 2024

CVE-2024-24799 on NVD →

The WooCommerce Box Office plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.1.50 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts i...

CVSS:

6.4

Affected:

up to 1.1.50

Fixed in:

1.1.51

Disclosed:

Jun 2, 2023

CVE-2023-34004 on NVD →

The WooCommerce Box Office plugin for WordPress is vulnerable to unauthorized access, modification, or loss of data due to a missing capability check on an unknown function in versions up to, and including, 1.1.51. This makes it possible for unauthenticated attackers to save ticket barcodes.

CVSS:

5.3

Affected:

up to 1.1.51

Fixed in:

1.1.52

Disclosed:

Jun 2, 2023

CVE-2023-34003 on NVD →