Ortto
Monthly
Unauthenticated configuration overwrite in the Ortto plugin for WordPress (versions before 1.0.25) lets a remote attacker rewrite the plugin's stored settings and turn the site into a delivery point for arbitrary scripts. The configuration-update request is never authenticated; the only gate is a secret that is exposed in public page HTML, so no credentials, user interaction, or non-default configuration is required on any site running an affected version. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, but the vendor has released a fix in 1.0.25 and the issue was reported by Canva, the plugin's maintainer.
Stored cross-site scripting in the Ortto plugin for WordPress before 1.0.25 lets an attacker with the ability to change the plugin's configuration save unescaped values that execute as JavaScript in an administrator's browser when the affected settings page is opened. Successful exploitation requires a high-privilege WordPress account that can already write the plugin's settings (PR:H) plus a victim administrator who subsequently visits that page (UI:R), which keeps this at CVSS 4.8 (Medium) and a this_month patching priority. The vendor has released 1.0.25 as the fix; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Information disclosure in the Ortto plugin for WordPress before 1.0.25 exposes WooCommerce product passwords and private product metadata to anyone who loads an affected public storefront page, with no authentication or user interaction required (CVSS 5.3, confidentiality-only, CWE-201). The impact is bounded by the store's own content: only sites running Ortto alongside WooCommerce that actually hold password-protected products or private product metadata have sensitive data to leak, and integrity and availability are unaffected. No public exploit has been identified at time of analysis, and a vendor fix ships in version 1.0.25.
Unauthenticated configuration overwrite in the Ortto plugin for WordPress (versions before 1.0.25) lets a remote attacker rewrite the plugin's stored settings and turn the site into a delivery point for arbitrary scripts. The configuration-update request is never authenticated; the only gate is a secret that is exposed in public page HTML, so no credentials, user interaction, or non-default configuration is required on any site running an affected version. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, but the vendor has released a fix in 1.0.25 and the issue was reported by Canva, the plugin's maintainer.
Stored cross-site scripting in the Ortto plugin for WordPress before 1.0.25 lets an attacker with the ability to change the plugin's configuration save unescaped values that execute as JavaScript in an administrator's browser when the affected settings page is opened. Successful exploitation requires a high-privilege WordPress account that can already write the plugin's settings (PR:H) plus a victim administrator who subsequently visits that page (UI:R), which keeps this at CVSS 4.8 (Medium) and a this_month patching priority. The vendor has released 1.0.25 as the fix; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Information disclosure in the Ortto plugin for WordPress before 1.0.25 exposes WooCommerce product passwords and private product metadata to anyone who loads an affected public storefront page, with no authentication or user interaction required (CVSS 5.3, confidentiality-only, CWE-201). The impact is bounded by the store's own content: only sites running Ortto alongside WooCommerce that actually hold password-protected products or private product metadata have sensitive data to leak, and integrity and availability are unaffected. No public exploit has been identified at time of analysis, and a vendor fix ships in version 1.0.25.