Threat Entry Updated 2024-11-21

CVE-2022-0234 - Woocs Plugin

The WOOCS WordPress plugin before 1.3.7.5 does not sanitise and escape the woocs_in_order_currency parameter of the woocs_get_products_price_html AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting

PLUGIN Woocs

CVE-2022-0234

MEDIUM CVSS 6.1 2022-02-21

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2021-25043 - Woocs Plugin

The WOOCS WordPress plugin before 1.3.7.3 does not sanitise and escape the custom_prices parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue

PLUGIN Woocs

CVE-2021-25043

MEDIUM CVSS 6.1 2022-01-10

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2021-24938 - Woocs Plugin

The WOOCS WordPress plugin before 1.3.7.1 does not sanitise and escape the key parameter of the woocs_update_profiles_data AJAX action (available to any authenticated user) before outputting it back in the response, leading to a Reflected cross-Site Scripting issue

PLUGIN Woocs

CVE-2021-24938

MEDIUM CVSS 6.1 2021-12-06

Risk Score

Open Full Technical Breakdown