Smart Manager
Monthly
Stored/reflected Cross-Site Scripting in the Smart Manager (smart-manager-for-wp-e-commerce) WordPress plugin by StoreApps affects all versions up to and including 8.90.0, allowing unauthenticated attackers to inject browser-executed script that runs in the context of a victim who follows a crafted link or triggers the vulnerable flow. Because the CVSS scope is changed (S:C), successful exploitation can impact the broader WordPress site beyond the plugin's own boundary, potentially leading to admin session theft or actions performed as a logged-in operator. Reported by Patchstack; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Privilege escalation in the StoreApps Smart Manager WordPress plugin (versions up to and including 8.85.0) allows authenticated low-privilege users to elevate themselves to higher-privileged roles due to incorrect privilege assignment (CWE-266). The flaw was reported by Patchstack and carries a CVSS 3.1 score of 8.8, though there is no public exploit identified at time of analysis and EPSS is very low at 0.04%. Affected WooCommerce stores running this plugin should treat this as a meaningful internal-risk issue because any subscriber, customer, or shop-manager account could be leveraged to seize administrator control.
Stored cross-site scripting in Smart Manager for WordPress before version 8.92.0 enables authenticated attackers with at least Contributor role to inject JavaScript that executes in an administrator's browser via the management grid. A publicly available proof-of-concept exists, though no active exploitation is confirmed. The vendor has released patched version 8.92.0.
The Smart Manager WordPress plugin before 8.28.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Improper configuration in Smart Manager prior to version 11.0.05.0 allows attacker to access the file with system privilege. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. No vendor patch available.
Stored/reflected Cross-Site Scripting in the Smart Manager (smart-manager-for-wp-e-commerce) WordPress plugin by StoreApps affects all versions up to and including 8.90.0, allowing unauthenticated attackers to inject browser-executed script that runs in the context of a victim who follows a crafted link or triggers the vulnerable flow. Because the CVSS scope is changed (S:C), successful exploitation can impact the broader WordPress site beyond the plugin's own boundary, potentially leading to admin session theft or actions performed as a logged-in operator. Reported by Patchstack; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Privilege escalation in the StoreApps Smart Manager WordPress plugin (versions up to and including 8.85.0) allows authenticated low-privilege users to elevate themselves to higher-privileged roles due to incorrect privilege assignment (CWE-266). The flaw was reported by Patchstack and carries a CVSS 3.1 score of 8.8, though there is no public exploit identified at time of analysis and EPSS is very low at 0.04%. Affected WooCommerce stores running this plugin should treat this as a meaningful internal-risk issue because any subscriber, customer, or shop-manager account could be leveraged to seize administrator control.
Stored cross-site scripting in Smart Manager for WordPress before version 8.92.0 enables authenticated attackers with at least Contributor role to inject JavaScript that executes in an administrator's browser via the management grid. A publicly available proof-of-concept exists, though no active exploitation is confirmed. The vendor has released patched version 8.92.0.
The Smart Manager WordPress plugin before 8.28.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Improper configuration in Smart Manager prior to version 11.0.05.0 allows attacker to access the file with system privilege. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. No vendor patch available.