Doofinder
Monthly
Doofinder for WooCommerce through 2.17.2 stores sensitive information in a file or directory that is reachable over the network, allowing an unauthenticated remote attacker to retrieve it (CVSS 3.1: 7.5, confidentiality-only). The available sources do not identify the specific exposed file, URL, or plugin feature, and no public exploit code or active exploitation is confirmed at time of analysis.
Doofinder for WooCommerce through version 2.10.13 discloses sensitive information by inserting it into sent data, allowing remote unauthenticated attackers to retrieve embedded secrets with low attack complexity. The vulnerability affects all installations of the plugin and has been reported by Patchstack, with EPSS exploitation probability at 0.02% (low real-world risk), though no KEV status or public exploit code has been identified.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Doofinder Doofinder for WooCommerce allows Stored XSS.1.8. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Doofinder Doofinder WP & WooCommerce Search.0.33. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Doofinder Doofinder WP & WooCommerce Search.5.49. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Doofinder Doofinder WP & WooCommerce Search allows Reflected XSS.1.7. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Doofinder for WooCommerce through 2.17.2 stores sensitive information in a file or directory that is reachable over the network, allowing an unauthenticated remote attacker to retrieve it (CVSS 3.1: 7.5, confidentiality-only). The available sources do not identify the specific exposed file, URL, or plugin feature, and no public exploit code or active exploitation is confirmed at time of analysis.
Doofinder for WooCommerce through version 2.10.13 discloses sensitive information by inserting it into sent data, allowing remote unauthenticated attackers to retrieve embedded secrets with low attack complexity. The vulnerability affects all installations of the plugin and has been reported by Patchstack, with EPSS exploitation probability at 0.02% (low real-world risk), though no KEV status or public exploit code has been identified.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Doofinder Doofinder for WooCommerce allows Stored XSS.1.8. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Doofinder Doofinder WP & WooCommerce Search.0.33. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Doofinder Doofinder WP & WooCommerce Search.5.49. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Doofinder Doofinder WP & WooCommerce Search allows Reflected XSS.1.7. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.