Woocommerce Shipping Multiple Addresses Vulnerabilities

[en] Missing Authorization vulnerability in Woo WooCommerce Ship to Multiple Addresses.This issue affects WooCommerce Ship to Multiple Addresses: from n/a through 3.8.5.

Affected:

up to 3.8.6

Fixed in:

3.8.6

Disclosed:

Jun 19, 2024

CVE-2023-37872 on NVD →

[en] Missing Authorization vulnerability in Woo WooCommerce Ship to Multiple Addresses.This issue affects WooCommerce Ship to Multiple Addresses: from n/a through 3.8.9.

Affected:

up to 3.8.10

Fixed in:

3.8.10

Disclosed:

Jun 14, 2024

CVE-2023-51497 on NVD →

The WooCommerce Ship to Multiple Addresses plugin for WordPress is vulnerable to unauthorized action due to a missing capability check on a function in versions up to, and including, 3.8.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 3.8.9

Fixed in:

3.8.10

Disclosed:

Dec 27, 2023

CVE-2023-51497 on NVD →

[en] Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce Shipping Multiple Addresses.This issue affects Shipping Multiple Addresses: from n/a through 3.8.3.

Affected:

up to 3.8.4

Fixed in:

3.8.4

Disclosed:

Dec 21, 2023

CVE-2023-32799 on NVD →

[en] Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Shipping Multiple Addresses plugin <= 3.8.5 versions.

Affected:

up to 3.8.6

Fixed in:

3.8.6

Disclosed:

Aug 5, 2023

CVE-2023-37873 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Shipping Multiple Addresses plugin <= 3.8.5 versions.

Affected:

up to 3.8.6

Fixed in:

3.8.6

Disclosed:

Jul 17, 2023

CVE-2023-36514 on NVD →

The WooCommerce Ship to Multiple Addresses plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on one of its functions in versions up to, and including, 3.8.5. This makes it possible for authenticated attackers, with customer-level access and above, to invoke this f...

CVSS:

6.3

Affected:

up to 3.8.5

Fixed in:

3.8.6

Disclosed:

Jul 10, 2023

CVE-2023-37872 on NVD →

The WooCommerce Ship to Multiple Addresses plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.8.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute i...

CVSS:

4.4

Affected:

up to 3.8.5

Fixed in:

3.8.6

Disclosed:

Jul 10, 2023

CVE-2023-37873 on NVD →

The WooCommerce Ship to Multiple Addresses plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.8.5. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a f...

CVSS:

4.3

Affected:

up to 3.8.5

Fixed in:

3.8.6

Disclosed:

Jun 26, 2023

CVE-2023-36514 on NVD →

The WooCommerce Ship to Multiple Addresses plugin for WordPress is vulnerable to insecure direct object reference in versions up to, and including, 3.8.3. This is due to insufficient validation on a user controlled key. The impact of this vulnerability is unknown.

CVSS:

4.3

Affected:

up to 3.8.3

Fixed in:

3.8.4

Disclosed:

May 15, 2023

CVE-2023-32799 on NVD →

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting

Affected:

up to 3.7.2

Fixed in:

3.7.2

The plugin does not have CSRF checks when creating, updating and deleting addresses, which could allow attackers to make logged in users perform such action via CSRF attacks

Affected:

up to 3.7.2

Fixed in:

3.7.2