Storegrowth
Monthly
Unauthenticated cross-site scripting in StoreGrowth: Smart Sales Booster for WooCommerce (BOGO, Upsells, Direct Checkout, Quick View, Side Cart) through version 2.0.6 lets remote attackers get script executed in a victim's browser when that user follows a crafted link or loads attacker-influenced input on a WordPress/WooCommerce store running the plugin. The assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (7.1) confirms no attacker authentication is needed but exploitation hinges on victim interaction, and the changed scope reflects that the payload runs in the affected store's origin rather than the attacker's. No public exploit code and no confirmed active exploitation are identified at time of analysis, so practical exposure is limited to sites where this WeDevs plugin is installed and active and the vulnerable parameter is reachable.
Broken access control in the StoreGrowth: Smart Sales Booster for WooCommerce plugin (versions <= 2.1.1) permits unauthenticated remote attackers to bypass authorization checks and perform privileged store management actions. The root cause is a missing authorization gate (CWE-862), meaning certain plugin endpoints execute sensitive operations without verifying the caller's identity or permissions. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the zero-friction exploitation conditions - no authentication, no user interaction, network-accessible - make this a straightforward target for opportunistic scanning.
Unauthenticated cross-site scripting in StoreGrowth: Smart Sales Booster for WooCommerce (BOGO, Upsells, Direct Checkout, Quick View, Side Cart) through version 2.0.6 lets remote attackers get script executed in a victim's browser when that user follows a crafted link or loads attacker-influenced input on a WordPress/WooCommerce store running the plugin. The assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (7.1) confirms no attacker authentication is needed but exploitation hinges on victim interaction, and the changed scope reflects that the payload runs in the affected store's origin rather than the attacker's. No public exploit code and no confirmed active exploitation are identified at time of analysis, so practical exposure is limited to sites where this WeDevs plugin is installed and active and the vulnerable parameter is reachable.
Broken access control in the StoreGrowth: Smart Sales Booster for WooCommerce plugin (versions <= 2.1.1) permits unauthenticated remote attackers to bypass authorization checks and perform privileged store management actions. The root cause is a missing authorization gate (CWE-862), meaning certain plugin endpoints execute sensitive operations without verifying the caller's identity or permissions. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the zero-friction exploitation conditions - no authentication, no user interaction, network-accessible - make this a straightforward target for opportunistic scanning.