Xootix

CVE-2026-12215 Sep 11, 03:39 MEDIUM This Month

Unauthenticated brute-force authentication bypass in the Xootix OTP Login & Register WooCommerce plugin (≤2.7.2) allows remote attackers to hijack any registered WordPress user's session - including administrators - by exhausting a trivially small OTP space. Two compounding flaws make this practical at scale: the rate-limit attempt counter is keyed on the attacker-controlled `xoo_ml_user_ip_data` cookie rather than the true network source address, enabling unlimited counter resets by rotating the cookie, while OTPs are generated with PHP's non-cryptographic `rand()` over only 9,000 possible values. Successful exploitation calls `wp_set_auth_cookie()`, granting a full WordPress authentication session. No public exploit code or CISA KEV listing has been identified at time of analysis.

CVE-2025-1064 Feb 20, 09:15 MEDIUM PATCH This Month

The Login/Signup Popup ( Inline Form + Woocommerce ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's xoo_el_action shortcode in all versions up to, and including,. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2024-8724 Sep 14, 04:15 MEDIUM PATCH This Month

The Waitlist Woocommerce ( Back in stock notifier ) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2024-5665 Jun 06, 08:15 MEDIUM PATCH This Month

The Login/Signup Popup ( Inline Form + Woocommerce ) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ‘export_settings’ function in versions. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.

CVE-2024-5324 Jun 06, 02:15 HIGH PATCH Act Now

Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the 'import_settings' function in various. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Epss exploitation probability 43.7%.

CVE-2023-28415 Aug 30, 16:15 MEDIUM POC This Month

Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2020-36715 Jun 07, 02:15 HIGH POC PATCH This Week

The Login/Signup Popup plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on several functions in versions up to, and including, 1.4. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

CVE-2023-2706 May 17, 02:15 HIGH PATCH This Week

The OTP Login Woocommerce & Gravity Forms plugin for WordPress is vulnerable to authentication bypass. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.