Wpc Smart Wishlist For Woocommerce
Monthly
Improper access control in WPC Smart Wishlist for WooCommerce through version 5.0.8 permits authenticated users to modify wishlist data they should not have authorization to access. An attacker with valid WordPress credentials could exploit misconfigured permission checks to alter or manipulate wishlist information belonging to other users.
A vulnerability in WPClever WPC Smart Wishlist for WooCommerce woo-smart-wishlist.7.1. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.9 does not sanitise and escape a parameter before outputting it back in an attribute via an AJAX action, leading to a Reflected. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.4 does not sanitise and escape the key parameter before outputting it back in the wishlist_quickview AJAX action's response. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Improper access control in WPC Smart Wishlist for WooCommerce through version 5.0.8 permits authenticated users to modify wishlist data they should not have authorization to access. An attacker with valid WordPress credentials could exploit misconfigured permission checks to alter or manipulate wishlist information belonging to other users.
A vulnerability in WPClever WPC Smart Wishlist for WooCommerce woo-smart-wishlist.7.1. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.9 does not sanitise and escape a parameter before outputting it back in an attribute via an AJAX action, leading to a Reflected. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.4 does not sanitise and escape the key parameter before outputting it back in the wishlist_quickview AJAX action's response. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.