plugin
34 known security issues reported for the Woocommerce Product Vendors WordPress plugin. Most recent disclosed Oct 16, 2024.
Running Woocommerce Product Vendors on your site? Check whether your installed version is affected.
Scan your site free[en] The Product Vendors is vulnerable to Reflected Cross-Site Scripting via the 'vendor_description' parameter in versions up to, and including, 2.0.35 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute...
[en] Missing Authorization vulnerability in Woo WooCommerce Product Vendors.This issue affects WooCommerce Product Vendors: from n/a through 2.2.2.
[en] Missing Authorization vulnerability in Woo WooCommerce Product Vendors.This issue affects WooCommerce Product Vendors: from n/a through 2.2.1.
The WooCommerce Product Vendors plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.2.2. This makes it possible for unauthenticated attackers to perform an unauthorized action.
The WooCommerce Product Vendors plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.2.1. This makes it possible for unauthenticated attackers to perform an unauthorized action.
[en] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce Product Vendors allows SQL Injection.This issue affects Product Vendors: from n/a through 2.1.76.
[en] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce Product Vendors allows SQL Injection.This issue affects Product Vendors: from n/a through 2.1.78.
The WooCommerce Product Vendors plugin for WordPress is vulnerable to SQL Injection via an unknown parameter in versions up to, and including, 2.1.78 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attack...
[en] Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Product Vendors plugin <= 2.1.76 versions.
The WooCommerce Product Vendors plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.1.76 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with vendor admin-le...
The WooCommerce Product Vendors plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.1.76 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can...
The WooCommerce Products Vendor plugin for WordPress is vulnerable to blind SQL Injection via the ‘s_postcode’ parameter in versions up to, and including, 2.1.65 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthen...
The WooCommerce Products Vendor plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.1.65. This is due to insufficient validation on the 'post_id' value supplied to the 'wc_product_vendors_vendor_add_order_note' AJAX action. This makes it possible for vendors to add...
The WooCommerce Products Vendor plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.1.65. This is due to insufficient validation on the data supplied to the 'wcpv-vendor-settings' page settings update. This makes it possible for vendors to modify their commissions...
The WooCommerce Products Vendor plugin for WordPress is vulnerable to blind SQL Injection via the ‘s_postcode’ parameter in versions up to, and including, 2.1.65 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthen...
The WooCommerce Products Vendor plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.1.65. This is due to insufficient validation on the data supplied to the 'wcpv-vendor-settings' page settings update. This makes it possible for vendors to modify their commissions...
The WooCommerce Products Vendor plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.1.65. This is due to insufficient validation on the 'post_id' value supplied to the 'wc_product_vendors_vendor_add_order_note' AJAX action. This makes it possible for vendors to add...
Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability found by Ramuel Gall (SiteLock) on WordPress WooCommerce Product Vendors plugin version 2.0.27 and earlier versions. The plugin doesn't appear to escape the "vendor description" POST parameter correctly and can be exploited to reflect arbitrary scriptin...
The Product Vendors is vulnerable to Reflected Cross-Site Scripting via the 'vendor_description' parameter in versions up to, and including, 2.0.35 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if th...
The Product Vendors is vulnerable to Reflected Cross-Site Scripting via the 'vendor_description' parameter in versions up to, and including, 2.0.35 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if th...
The plugin does not ensure that vendors can not update the commission percentage set by shop admin, as a result, vendors can set their own commission percentage by making a crafted request
The plugin does not ensure that notes to be created on an order belongs to the vendor doing it, allowing any vendor to create arbitrary note on other vendors' orders via an IDOR
The plugin does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users
The woocommerce-product-vendors WordPress plugin was affected by an Unauthenticated Reflected XSS security vulnerability.
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free