Fox
Monthly
Blind SQL injection in FOX WooCommerce Currency Switcher plugin (versions ≤1.4.5) allows authenticated high-privilege users to extract database contents via crafted SQL commands. Attacker requires high-privilege access (PR:H) but can breach scope boundaries (S:C), achieving high confidentiality impact and limited availability disruption. No public exploit identified at time of analysis. Affects WordPress installations using the vulnerable plugin for multi-currency e-commerce functionality.
Missing authorization in the FOX (WooCommerce Currency Switcher) WordPress plugin through version 1.5.4 allows remote attackers to reach plugin functionality that should require privileged access, tampering with data or settings within the plugin's scope. The assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N means it is exploitable over the network by unauthenticated attackers with no user interaction, but the consequence is confined to a partial integrity impact - no data disclosure and no availability loss. Severity is moderate (CVSS 5.3), and no public exploit identified at time of analysis; there is no CISA KEV listing for this CVE.
Missing authorization in RealMag777 FOX woocommerce-currency-switcher plugin for WordPress allows unauthenticated remote attackers to bypass access controls and gain read access to sensitive data through incorrectly configured security levels. The vulnerability affects FOX versions up to and including 1.4.5, with a CVSS score of 5.3 and extremely low exploitation probability (EPSS 0.02%), suggesting limited real-world attack incentive despite the missing authorization flaw.
Blind SQL injection in FOX WooCommerce Currency Switcher plugin (versions ≤1.4.5) allows authenticated high-privilege users to extract database contents via crafted SQL commands. Attacker requires high-privilege access (PR:H) but can breach scope boundaries (S:C), achieving high confidentiality impact and limited availability disruption. No public exploit identified at time of analysis. Affects WordPress installations using the vulnerable plugin for multi-currency e-commerce functionality.
Missing authorization in the FOX (WooCommerce Currency Switcher) WordPress plugin through version 1.5.4 allows remote attackers to reach plugin functionality that should require privileged access, tampering with data or settings within the plugin's scope. The assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N means it is exploitable over the network by unauthenticated attackers with no user interaction, but the consequence is confined to a partial integrity impact - no data disclosure and no availability loss. Severity is moderate (CVSS 5.3), and no public exploit identified at time of analysis; there is no CISA KEV listing for this CVE.
Missing authorization in RealMag777 FOX woocommerce-currency-switcher plugin for WordPress allows unauthenticated remote attackers to bypass access controls and gain read access to sensitive data through incorrectly configured security levels. The vulnerability affects FOX versions up to and including 1.4.5, with a CVSS score of 5.3 and extremely low exploitation probability (EPSS 0.02%), suggesting limited real-world attack incentive despite the missing authorization flaw.