Read the docs

ali2woo

Records5All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9

Exploited now

ali2woo records in CISA KEV

No ali2woo vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Aliexpress Dropshipping With Alinext 4 records MEDIUM

Records

5 records

TI-2024-02212 CVE-2024-2381 · GHSA-vf9x-9xc7-h8c7

AliExpress Dropshipping with AliNext Lite <= 3.3.5 - Authenticated (Subscriber+) Arbitrary File Upload

Priority MEDIUM 42

The AliExpress Dropshipping with AliNext Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_save_image function in all versions up to, and including, 3.3.5.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00912 Published 2024-06-19 No fix listed CWE-434
TI-2024-24726 CVE-2024-37211 · GHSA-cvr6-66wr-f2c5

WordPress AliExpress Dropshipping with AliNext Lite plugin <= 3.3.5 - Reflected Cross Site Scripting (XSS) vulnerability

Priority LOW 31

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ali2Woo Team Ali2Woo Lite allows Reflected XSS.This issue affects Ali2Woo Lite: from n/a through 3.3.5.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00272 Published 2024-07-22 No fix listed CWE-79
TI-2024-04140 CVE-2024-4450 · GHSA-j553-72x4-g3hq

AliExpress Dropshipping with AliNext Lite <= 3.3.6 - Missing Authorization via Several Functions

Priority LOW 28

The AliExpress Dropshipping with AliNext Lite plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the ImportAjaxController.php file in all versions up to, a…

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00331 Published 2024-06-19 No fix listed CWE-862
Open these records in search →