Upsell Order Bump Offer For Woocommerce
Monthly
Unauthenticated cross-site scripting in the Upsell Order Bump Offer for WooCommerce plugin (WP Swings) allows remote attackers to inject malicious scripts into victim browsers by tricking authenticated users into visiting a crafted URL. All versions through 3.1.5 are confirmed affected per CPE data published by Patchstack. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Broken authentication in the Upsell Order Bump Offer for WooCommerce plugin (versions 3.1.4 and earlier) allows remote unauthenticated attackers to manipulate offer/price integrity on affected WordPress storefronts. Patchstack classifies the issue as a price manipulation vulnerability with high integrity impact, and no public exploit identified at time of analysis. The defect is reachable over the network without authentication or user interaction, making any WooCommerce store running the plugin a direct target.
Unauthenticated cross-site scripting in the Upsell Order Bump Offer for WooCommerce plugin (WP Swings) allows remote attackers to inject malicious scripts into victim browsers by tricking authenticated users into visiting a crafted URL. All versions through 3.1.5 are confirmed affected per CPE data published by Patchstack. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Broken authentication in the Upsell Order Bump Offer for WooCommerce plugin (versions 3.1.4 and earlier) allows remote unauthenticated attackers to manipulate offer/price integrity on affected WordPress storefronts. Patchstack classifies the issue as a price manipulation vulnerability with high integrity impact, and no public exploit identified at time of analysis. The defect is reachable over the network without authentication or user interaction, making any WooCommerce store running the plugin a direct target.