Wpclever
Monthly
Stored cross-site scripting in WPC Product Options for WooCommerce 4.0.5 and earlier allows unauthenticated attackers to inject arbitrary JavaScript into WooCommerce order item meta and have it execute in a store administrator's browser session. The injection happens through a guest-checkout path where the malicious payload is placed inside a multipart/form-data Content-Disposition field name prefixed with 'wpcpo-', a technique that bypasses the plugin's sanitization because PHP's RFC1867 parser preserves raw field names byte-for-byte; the script then fires when a privileged user (realistically an admin reviewing the order in wp-admin) opens the affected page. At CVSS 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) and with authentication requirements confirmed as unauthenticated (PR:N) by the vector, the injection step is easy to reach on any shop with guest checkout enabled, but the deferred, victim-triggered execution and the need for an admin to view the poisoned order bound the practical impact; no public exploit code was identified at time of analysis and there is no CISA KEV entry.
Authenticated privilege escalation in WPC Shop as a Customer for WooCommerce (versions up to and including 2.0.0) enables any logged-in user to take over an Administrator account by supplying the Administrator's user ID to the wpcsa_login endpoint, receiving a full Administrator session cookie without the Administrator's password. The flaw stems from missing role validation (CWE-269) before issuing a session, and WordPress user IDs are trivially enumerable. No public exploit code is identified at time of analysis, but the vendor-released patch 2.0.1 is available and this is assessed as a genuine high-priority vulnerability.
Stored cross-site scripting in WPC Product Bundles for WooCommerce, in all versions up to and including 8.6.6, allows an unauthenticated attacker to inject arbitrary JavaScript through the 'qty' parameter that is then persisted in order item metadata under the '_woosb_ids' key. Because the plugin casts the quantity to a float during validation, a numeric-prefixed payload such as '1<img src=x onerror=...>' passes the check while retaining its malicious HTML, which is stored verbatim and executes when a WordPress administrator or shop manager later opens the affected order record. Wordfence reported the issue with a CVSS 3.1 base score of 7.2 and an independent assessment of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, meaning exploitation also depends on a privileged user viewing the injected data; no public exploit code and no CISA KEV entry were identified at time of analysis, and exploitation additionally requires a WooCommerce store with the plugin active and at least one bundle product available for ordering.
Unauthenticated arbitrary file download in the WPC Product Options for WooCommerce WordPress plugin (versions ≤ 3.2.1) allows remote attackers to retrieve arbitrary files from the underlying server without any credentials. The flaw is a classic path traversal (CWE-22) reachable over the network at low complexity, and while no public exploit identified at time of analysis, the disclosure by Patchstack and trivial attack profile make opportunistic scanning likely against WooCommerce storefronts running this plugin.
Unauthorized data tampering in the WPC Product Bundles for WooCommerce WordPress plugin (versions 8.5.3 and earlier) allows remote attackers to manipulate plugin state without authentication due to missing authorization checks. Reported by Patchstack, the flaw carries a CVSS 7.5 reflecting high integrity impact with no confidentiality or availability impact, and no public exploit identified at time of analysis.
Reflected cross-site scripting (CWE-79) in the WPC Estimated Delivery Date for WooCommerce plugin, affecting all versions up to and including 4.0.1, allows unauthenticated attackers to inject arbitrary web scripts via the 'rule_data' parameter, which execute in a victim's browser if they are tricked into clicking a crafted link. The vulnerability arises from insufficient input sanitization and output escaping, and although no public exploit code is identified at time of analysis, the CVSS 3.1 base score is 6.1 (Medium) with a user-interaction requirement (UI:R). The primary limiting factor is the need to persuade a victim to perform an action; the scope is changed (S:C) because the script runs in the context of the victim's session.
Reflected cross-site scripting in the WPC Smart Quick View for WooCommerce WordPress plugin, affecting all versions up to and including 4.4.0, lets unauthenticated attackers inject arbitrary JavaScript into a page that executes in the browser of a victim who opens a crafted URL, since the 'woosq-redirect' parameter is neither sanitized on input nor escaped on output (CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Exploitation is configuration-dependent: the WooCommerce 'redirect to cart after add to cart' option must be enabled for the code path that reads the parameter to run, but once it is, the '?quick-view=' auto-open mechanism means no victim interaction beyond loading the link is required, though the attacker must still lure a user into clicking (UI:R) and no attacker authentication is needed (PR:N). No public exploit code was identified at time of analysis and there is no CISA KEV listing, so this should be treated as a routine patch-management priority rather than an emergency.
Stored Cross-Site Scripting in the WPC Badge Management for WooCommerce WordPress plugin (all versions through 3.1.6) allows authenticated attackers with Contributor-level access to inject persistent JavaScript via the 'text' attribute of the wpcbm_best_seller shortcode. The injected payload executes silently in the browser of any visitor who loads an affected page, with scope change indicated by the CVSS S:C metric. No public exploit or CISA KEV listing is identified at time of analysis.
Stored Cross-Site Scripting in WPC Badge Management for WooCommerce plugin versions up to 3.1.6 allows authenticated attackers with Shop Manager-level access to inject arbitrary JavaScript via the 'text' attribute of the wpcbm_best_seller shortcode. The injected scripts execute in the browsers of any user visiting the affected page, enabling credential theft, session hijacking, or defacement. The vulnerability stems from insufficient input sanitization and output escaping in shortcode processing.
Stored cross-site scripting in WPC Smart Messages for WooCommerce plugin through version 4.2.8 allows authenticated attackers with contributor-level access to inject arbitrary JavaScript via the 'text' attribute of the wpcsm_text_rotator shortcode, resulting in execution whenever users view affected pages. The vulnerability stems from insufficient input sanitization and output escaping. No active exploitation confirmed; patch available in version 4.2.9.
Improper access control in WPC Smart Wishlist for WooCommerce through version 5.0.8 permits authenticated users to modify wishlist data they should not have authorization to access. An attacker with valid WordPress credentials could exploit misconfigured permission checks to alter or manipulate wishlist information belonging to other users.
WPC Product Bundles for WooCommerce versions through 8.4.5 contains a missing authorization flaw that allows authenticated users to exploit misconfigured access controls and access sensitive information. An attacker with valid WordPress credentials could leverage this vulnerability to view restricted data within the plugin. No patch is currently available for this medium-severity issue affecting WooCommerce installations.
The WPC Smart Compare for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shortcode_btn' shortcode in all versions up to, and including, 6.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Missing Authorization vulnerability in WPClever WPC Frequently Bought Together for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.1.9. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Deserialization of Untrusted Data vulnerability in WPClever WPC Shop as a Customer for WooCommerce wpc-shop-as-customer allows Object Injection.2.6. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in WPClever WPC Badge Management for WooCommerce.4.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.0.2 due to insufficient input. Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Cross-Site Request Forgery (CSRF) vulnerability in WPClever WPC Product Bundles for WooCommerce.3.1. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability in WPClever WPC Smart Wishlist for WooCommerce woo-smart-wishlist.7.1. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.9 does not sanitise and escape a parameter before outputting it back in an attribute via an AJAX action, leading to a Reflected. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.4 does not sanitise and escape the key parameter before outputting it back in the wishlist_quickview AJAX action's response. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Stored cross-site scripting in WPC Product Options for WooCommerce 4.0.5 and earlier allows unauthenticated attackers to inject arbitrary JavaScript into WooCommerce order item meta and have it execute in a store administrator's browser session. The injection happens through a guest-checkout path where the malicious payload is placed inside a multipart/form-data Content-Disposition field name prefixed with 'wpcpo-', a technique that bypasses the plugin's sanitization because PHP's RFC1867 parser preserves raw field names byte-for-byte; the script then fires when a privileged user (realistically an admin reviewing the order in wp-admin) opens the affected page. At CVSS 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) and with authentication requirements confirmed as unauthenticated (PR:N) by the vector, the injection step is easy to reach on any shop with guest checkout enabled, but the deferred, victim-triggered execution and the need for an admin to view the poisoned order bound the practical impact; no public exploit code was identified at time of analysis and there is no CISA KEV entry.
Authenticated privilege escalation in WPC Shop as a Customer for WooCommerce (versions up to and including 2.0.0) enables any logged-in user to take over an Administrator account by supplying the Administrator's user ID to the wpcsa_login endpoint, receiving a full Administrator session cookie without the Administrator's password. The flaw stems from missing role validation (CWE-269) before issuing a session, and WordPress user IDs are trivially enumerable. No public exploit code is identified at time of analysis, but the vendor-released patch 2.0.1 is available and this is assessed as a genuine high-priority vulnerability.
Stored cross-site scripting in WPC Product Bundles for WooCommerce, in all versions up to and including 8.6.6, allows an unauthenticated attacker to inject arbitrary JavaScript through the 'qty' parameter that is then persisted in order item metadata under the '_woosb_ids' key. Because the plugin casts the quantity to a float during validation, a numeric-prefixed payload such as '1<img src=x onerror=...>' passes the check while retaining its malicious HTML, which is stored verbatim and executes when a WordPress administrator or shop manager later opens the affected order record. Wordfence reported the issue with a CVSS 3.1 base score of 7.2 and an independent assessment of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, meaning exploitation also depends on a privileged user viewing the injected data; no public exploit code and no CISA KEV entry were identified at time of analysis, and exploitation additionally requires a WooCommerce store with the plugin active and at least one bundle product available for ordering.
Unauthenticated arbitrary file download in the WPC Product Options for WooCommerce WordPress plugin (versions ≤ 3.2.1) allows remote attackers to retrieve arbitrary files from the underlying server without any credentials. The flaw is a classic path traversal (CWE-22) reachable over the network at low complexity, and while no public exploit identified at time of analysis, the disclosure by Patchstack and trivial attack profile make opportunistic scanning likely against WooCommerce storefronts running this plugin.
Unauthorized data tampering in the WPC Product Bundles for WooCommerce WordPress plugin (versions 8.5.3 and earlier) allows remote attackers to manipulate plugin state without authentication due to missing authorization checks. Reported by Patchstack, the flaw carries a CVSS 7.5 reflecting high integrity impact with no confidentiality or availability impact, and no public exploit identified at time of analysis.
Reflected cross-site scripting (CWE-79) in the WPC Estimated Delivery Date for WooCommerce plugin, affecting all versions up to and including 4.0.1, allows unauthenticated attackers to inject arbitrary web scripts via the 'rule_data' parameter, which execute in a victim's browser if they are tricked into clicking a crafted link. The vulnerability arises from insufficient input sanitization and output escaping, and although no public exploit code is identified at time of analysis, the CVSS 3.1 base score is 6.1 (Medium) with a user-interaction requirement (UI:R). The primary limiting factor is the need to persuade a victim to perform an action; the scope is changed (S:C) because the script runs in the context of the victim's session.
Reflected cross-site scripting in the WPC Smart Quick View for WooCommerce WordPress plugin, affecting all versions up to and including 4.4.0, lets unauthenticated attackers inject arbitrary JavaScript into a page that executes in the browser of a victim who opens a crafted URL, since the 'woosq-redirect' parameter is neither sanitized on input nor escaped on output (CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Exploitation is configuration-dependent: the WooCommerce 'redirect to cart after add to cart' option must be enabled for the code path that reads the parameter to run, but once it is, the '?quick-view=' auto-open mechanism means no victim interaction beyond loading the link is required, though the attacker must still lure a user into clicking (UI:R) and no attacker authentication is needed (PR:N). No public exploit code was identified at time of analysis and there is no CISA KEV listing, so this should be treated as a routine patch-management priority rather than an emergency.
Stored Cross-Site Scripting in the WPC Badge Management for WooCommerce WordPress plugin (all versions through 3.1.6) allows authenticated attackers with Contributor-level access to inject persistent JavaScript via the 'text' attribute of the wpcbm_best_seller shortcode. The injected payload executes silently in the browser of any visitor who loads an affected page, with scope change indicated by the CVSS S:C metric. No public exploit or CISA KEV listing is identified at time of analysis.
Stored Cross-Site Scripting in WPC Badge Management for WooCommerce plugin versions up to 3.1.6 allows authenticated attackers with Shop Manager-level access to inject arbitrary JavaScript via the 'text' attribute of the wpcbm_best_seller shortcode. The injected scripts execute in the browsers of any user visiting the affected page, enabling credential theft, session hijacking, or defacement. The vulnerability stems from insufficient input sanitization and output escaping in shortcode processing.
Stored cross-site scripting in WPC Smart Messages for WooCommerce plugin through version 4.2.8 allows authenticated attackers with contributor-level access to inject arbitrary JavaScript via the 'text' attribute of the wpcsm_text_rotator shortcode, resulting in execution whenever users view affected pages. The vulnerability stems from insufficient input sanitization and output escaping. No active exploitation confirmed; patch available in version 4.2.9.
Improper access control in WPC Smart Wishlist for WooCommerce through version 5.0.8 permits authenticated users to modify wishlist data they should not have authorization to access. An attacker with valid WordPress credentials could exploit misconfigured permission checks to alter or manipulate wishlist information belonging to other users.
WPC Product Bundles for WooCommerce versions through 8.4.5 contains a missing authorization flaw that allows authenticated users to exploit misconfigured access controls and access sensitive information. An attacker with valid WordPress credentials could leverage this vulnerability to view restricted data within the plugin. No patch is currently available for this medium-severity issue affecting WooCommerce installations.
The WPC Smart Compare for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shortcode_btn' shortcode in all versions up to, and including, 6.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Missing Authorization vulnerability in WPClever WPC Frequently Bought Together for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.1.9. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Deserialization of Untrusted Data vulnerability in WPClever WPC Shop as a Customer for WooCommerce wpc-shop-as-customer allows Object Injection.2.6. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in WPClever WPC Badge Management for WooCommerce.4.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.0.2 due to insufficient input. Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Cross-Site Request Forgery (CSRF) vulnerability in WPClever WPC Product Bundles for WooCommerce.3.1. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability in WPClever WPC Smart Wishlist for WooCommerce woo-smart-wishlist.7.1. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.9 does not sanitise and escape a parameter before outputting it back in an attribute via an AJAX action, leading to a Reflected. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.4 does not sanitise and escape the key parameter before outputting it back in the wishlist_quickview AJAX action's response. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.