Upsell Order Bump Offer For Woocommerce
Monthly
Reflected cross-site scripting (CWE-79) in the WP Swings 'Upsell Order Bump Offer for WooCommerce' WordPress plugin affects every version up to and including 3.1.6, allowing an unauthenticated remote attacker to craft a request whose input the plugin reflects unsanitized into a generated page. Because the CVSS vector carries UI:R, the payload only executes when a victim follows the crafted request in their browser, so practical exploitation depends on lure- or social-engineering-based delivery rather than direct server-side triggering; the score is elevated to 7.1 by the S:C scope change and low confidentiality, integrity and availability impacts. No CISA KEV listing or confirmed public exploit code is present in the supplied intelligence, and the exact vulnerable parameter or endpoint is not described in the available sources.
Unauthenticated cross-site scripting in the Upsell Order Bump Offer for WooCommerce plugin (WP Swings) allows remote attackers to inject malicious scripts into victim browsers by tricking authenticated users into visiting a crafted URL. All versions through 3.1.5 are confirmed affected per CPE data published by Patchstack. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Broken authentication in the Upsell Order Bump Offer for WooCommerce plugin (versions 3.1.4 and earlier) allows remote unauthenticated attackers to manipulate offer/price integrity on affected WordPress storefronts. Patchstack classifies the issue as a price manipulation vulnerability with high integrity impact, and no public exploit identified at time of analysis. The defect is reachable over the network without authentication or user interaction, making any WooCommerce store running the plugin a direct target.
Reflected cross-site scripting (CWE-79) in the WP Swings 'Upsell Order Bump Offer for WooCommerce' WordPress plugin affects every version up to and including 3.1.6, allowing an unauthenticated remote attacker to craft a request whose input the plugin reflects unsanitized into a generated page. Because the CVSS vector carries UI:R, the payload only executes when a victim follows the crafted request in their browser, so practical exploitation depends on lure- or social-engineering-based delivery rather than direct server-side triggering; the score is elevated to 7.1 by the S:C scope change and low confidentiality, integrity and availability impacts. No CISA KEV listing or confirmed public exploit code is present in the supplied intelligence, and the exact vulnerable parameter or endpoint is not described in the available sources.
Unauthenticated cross-site scripting in the Upsell Order Bump Offer for WooCommerce plugin (WP Swings) allows remote attackers to inject malicious scripts into victim browsers by tricking authenticated users into visiting a crafted URL. All versions through 3.1.5 are confirmed affected per CPE data published by Patchstack. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Broken authentication in the Upsell Order Bump Offer for WooCommerce plugin (versions 3.1.4 and earlier) allows remote unauthenticated attackers to manipulate offer/price integrity on affected WordPress storefronts. Patchstack classifies the issue as a price manipulation vulnerability with high integrity impact, and no public exploit identified at time of analysis. The defect is reachable over the network without authentication or user interaction, making any WooCommerce store running the plugin a direct target.