Woodiscuz Woocommerce Comments Vulnerabilities

[en] Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team WooDiscuz – WooCommerce Comments.This issue affects WooDiscuz – WooCommerce Comments: from n/a through 2.3.0.

Affected:

up to 2.3.0

Fix:

No patched version reported

Disclosed:

Dec 18, 2023

CVE-2023-49759 on NVD →

The WooDiscuz – WooCommerce Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.0. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged...

CVSS:

4.3

Affected:

up to 2.3.0

Fix:

No patched version reported

Disclosed:

Dec 4, 2023

CVE-2023-49759 on NVD →

[en] Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in gVectors Team WooDiscuz – WooCommerce Comments woodiscuz-woocommerce-comments allows Stored XSS.This issue affects WooDiscuz – WooCommerce Comments: from n/a through 2.2.9.

Affected:

up to 2.3.0

Fixed in:

2.3.0

Disclosed:

May 28, 2023

CVE-2023-33216 on NVD →

The WooDiscuz – WooCommerce Comments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 2.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above...

CVSS:

4.4

Affected:

up to 2.2.9

Fixed in:

2.3.0

Disclosed:

May 19, 2023

CVE-2023-33216 on NVD →

The WooDiscuz – WooCommerce Comments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 2.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above...

Affected:

up to 2.3.0

Fixed in:

2.3.0

Disclosed:

May 19, 2023