Colissimo Officiel
Monthly
Unauthenticated cross-site scripting in the Colissimo Officiel WooCommerce shipping plugin (versions <= 2.10.0) allows remote, unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser when they interact with a crafted request. The CVSS scope change (S:C) confirms the exploit crosses from the plugin's security context into the broader browser environment, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated, low-complexity nature of the flaw makes it straightforward to weaponize against any WordPress site running the affected plugin.
Insecure Direct Object Reference (IDOR) in the Colissimo Officiel WooCommerce shipping plugin (≤2.10.0) enables authenticated low-privileged customers to access shipping or order objects belonging to other users by manipulating controllable object references in plugin requests. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) confirms network-exploitable, low-complexity exploitation limited to authenticated WooCommerce customer accounts, with impact confined to limited confidentiality exposure of delivery data. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated IDOR in Colissimo Officiel : Méthodes de livraison pour WooCommerce (versions ≤ 2.9.0) exposes shipping-related backend objects to manipulation by remote, unauthenticated attackers. Missing server-side authorization on object lookups allows adversaries to reference records belonging to other users, producing low integrity and availability impacts on WooCommerce shipping data with no confidentiality breach. No public exploit code or active exploitation has been identified at time of analysis, and no patched version number was independently confirmed in the available intelligence.
Unauthenticated cross-site scripting in the Colissimo Officiel WooCommerce shipping plugin (versions <= 2.10.0) allows remote, unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser when they interact with a crafted request. The CVSS scope change (S:C) confirms the exploit crosses from the plugin's security context into the broader browser environment, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated, low-complexity nature of the flaw makes it straightforward to weaponize against any WordPress site running the affected plugin.
Insecure Direct Object Reference (IDOR) in the Colissimo Officiel WooCommerce shipping plugin (≤2.10.0) enables authenticated low-privileged customers to access shipping or order objects belonging to other users by manipulating controllable object references in plugin requests. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) confirms network-exploitable, low-complexity exploitation limited to authenticated WooCommerce customer accounts, with impact confined to limited confidentiality exposure of delivery data. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated IDOR in Colissimo Officiel : Méthodes de livraison pour WooCommerce (versions ≤ 2.9.0) exposes shipping-related backend objects to manipulation by remote, unauthenticated attackers. Missing server-side authorization on object lookups allows adversaries to reference records belonging to other users, producing low integrity and availability impacts on WooCommerce shipping data with no confidentiality breach. No public exploit code or active exploitation has been identified at time of analysis, and no patched version number was independently confirmed in the available intelligence.