Premmerce
Monthly
Cross-site scripting in the WordPress plugin Premmerce Wishlist for WooCommerce (versions up to and including 1.1.13) allows an unauthenticated remote attacker to inject script that executes in a victim's browser, with a CVSS 3.1 base score of 7.1 and a scope change (S:C) reflecting that the injected code can affect resources beyond the vulnerable plugin itself. Because the vector is PR:N, no credentials are needed to craft the payload, but the CVSS vector's UI:R means exploitation only succeeds when a victim with an active browser session is lured into opening a crafted link or supplying malicious input; the site must have the vulnerable plugin installed and the targeted page or parameter reachable. No public exploit identified at time of analysis, the plugin has not been reported in CISA KEV, and no EPSS data was supplied, so the practical risk leans moderate rather than urgent.
Unauthenticated cross-site scripting in the Premmerce Wishlist for WooCommerce WordPress plugin (versions 1.1.13 and earlier) allows remote attackers to inject script that executes in the target site's own origin once a victim is induced to load attacker-influenced content or click a crafted link. Because the CVSS vector is PR:N, no account on the WordPress site is required to deliver the payload, but exploitation is gated by UI:R - the script only runs after a victim interacts with the malicious page or link - and the effect is confined to client-side script execution in the browser, with no server-side code execution, file write, or database compromise demonstrated by the available data. No public exploit code or in-the-wild exploitation is identified in the supplied intelligence, and the EPSS/KEV signals are absent; the Patchstack advisory is the sole reference, so overall confidence in the details of the injectable parameter is limited even though the affected version range is explicit.
Unauthenticated cross-site scripting in Premmerce Permalink Manager for WooCommerce (versions 2.3.13 and earlier) allows remote attackers to inject script that executes in the context of a victim's browser when the crafted content is rendered. Because the CVSS vector carries PR:N with UI:R, no attacker credentials are required, but successful exploitation depends on a victim - typically a logged-in WordPress administrator - interacting with the attacker-influenced page, which is the primary limiting factor; the S:C scope-change flag means the injected script runs in a different security context (the admin session/browser) than the vulnerable plugin itself. No public exploit code or confirmed active exploitation was identified at time of analysis, and the site must be running WooCommerce with this specific plugin installed and active for exposure.
SQL injection in the Premmerce Wishlist for WooCommerce WordPress plugin (versions 1.1.11 and earlier) lets remote unauthenticated attackers inject crafted SQL into backend database queries, per the CVSS PR:N vector. Reported by Patchstack and rated 9.3 (CVSS 3.1), it allows extraction of sensitive WordPress/WooCommerce data such as user records and credential hashes. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and no EPSS score was provided.
Remote code execution in the Premmerce Dev Tools WordPress plugin (versions ≤ 2.0) allows authenticated users with Subscriber-level access or higher to write arbitrary PHP files into wp-content/plugins/ by injecting payloads into the premmerce_plugin_namespace POST parameter. The flaw stems from a missing authorization check in generatePluginHandler combined with unsanitized string substitution in createFromStub, enabling attackers to escape the namespace context with a semicolon and execute arbitrary PHP on the host. No public exploit identified at time of analysis, but the low privilege barrier and the high-impact CVSS 8.8 score make this a serious risk on sites with open registration.
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper access control in Premmerce Redirect Manager through version 1.0.12 permits authenticated users to bypass authorization checks and manipulate redirect configurations. An attacker with valid credentials could exploit this vulnerability to modify, view, or delete redirects they should not have access to, potentially affecting website traffic and user experience. A patch is not currently available.
Missing Authorization vulnerability in Premmerce Premmerce Product Filter for WooCommerce premmerce-woocommerce-product-filter.7.2. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Premmerce plugin <= 1.3.17 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Premmerce Premmerce Redirect Manager plugin <= 1.0.9 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-site scripting in the WordPress plugin Premmerce Wishlist for WooCommerce (versions up to and including 1.1.13) allows an unauthenticated remote attacker to inject script that executes in a victim's browser, with a CVSS 3.1 base score of 7.1 and a scope change (S:C) reflecting that the injected code can affect resources beyond the vulnerable plugin itself. Because the vector is PR:N, no credentials are needed to craft the payload, but the CVSS vector's UI:R means exploitation only succeeds when a victim with an active browser session is lured into opening a crafted link or supplying malicious input; the site must have the vulnerable plugin installed and the targeted page or parameter reachable. No public exploit identified at time of analysis, the plugin has not been reported in CISA KEV, and no EPSS data was supplied, so the practical risk leans moderate rather than urgent.
Unauthenticated cross-site scripting in the Premmerce Wishlist for WooCommerce WordPress plugin (versions 1.1.13 and earlier) allows remote attackers to inject script that executes in the target site's own origin once a victim is induced to load attacker-influenced content or click a crafted link. Because the CVSS vector is PR:N, no account on the WordPress site is required to deliver the payload, but exploitation is gated by UI:R - the script only runs after a victim interacts with the malicious page or link - and the effect is confined to client-side script execution in the browser, with no server-side code execution, file write, or database compromise demonstrated by the available data. No public exploit code or in-the-wild exploitation is identified in the supplied intelligence, and the EPSS/KEV signals are absent; the Patchstack advisory is the sole reference, so overall confidence in the details of the injectable parameter is limited even though the affected version range is explicit.
Unauthenticated cross-site scripting in Premmerce Permalink Manager for WooCommerce (versions 2.3.13 and earlier) allows remote attackers to inject script that executes in the context of a victim's browser when the crafted content is rendered. Because the CVSS vector carries PR:N with UI:R, no attacker credentials are required, but successful exploitation depends on a victim - typically a logged-in WordPress administrator - interacting with the attacker-influenced page, which is the primary limiting factor; the S:C scope-change flag means the injected script runs in a different security context (the admin session/browser) than the vulnerable plugin itself. No public exploit code or confirmed active exploitation was identified at time of analysis, and the site must be running WooCommerce with this specific plugin installed and active for exposure.
SQL injection in the Premmerce Wishlist for WooCommerce WordPress plugin (versions 1.1.11 and earlier) lets remote unauthenticated attackers inject crafted SQL into backend database queries, per the CVSS PR:N vector. Reported by Patchstack and rated 9.3 (CVSS 3.1), it allows extraction of sensitive WordPress/WooCommerce data such as user records and credential hashes. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and no EPSS score was provided.
Remote code execution in the Premmerce Dev Tools WordPress plugin (versions ≤ 2.0) allows authenticated users with Subscriber-level access or higher to write arbitrary PHP files into wp-content/plugins/ by injecting payloads into the premmerce_plugin_namespace POST parameter. The flaw stems from a missing authorization check in generatePluginHandler combined with unsanitized string substitution in createFromStub, enabling attackers to escape the namespace context with a semicolon and execute arbitrary PHP on the host. No public exploit identified at time of analysis, but the low privilege barrier and the high-impact CVSS 8.8 score make this a serious risk on sites with open registration.
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper access control in Premmerce Redirect Manager through version 1.0.12 permits authenticated users to bypass authorization checks and manipulate redirect configurations. An attacker with valid credentials could exploit this vulnerability to modify, view, or delete redirects they should not have access to, potentially affecting website traffic and user experience. A patch is not currently available.
Missing Authorization vulnerability in Premmerce Premmerce Product Filter for WooCommerce premmerce-woocommerce-product-filter.7.2. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Premmerce plugin <= 1.3.17 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Premmerce Premmerce Redirect Manager plugin <= 1.0.9 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.