Read the docs

xootix

Records15All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9

Exploited now

xootix records in CISA KEV

No xootix vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Login/signup Popup 5 records MEDIUM Side Cart Woocommerce 4 records MEDIUM Waitlist Woocommerce 3 records MEDIUM Otp Login Woocommerce & Gravity Forms 2 records MEDIUM

Records

5 records in Login/signup Popup · all components

TI-2022-00152 CVE-2022-0215 · GHSA-824x-r58x-c6fc

XootiX Plugins <= Various Versions Cross-Site Request Forgery to Arbitrary Options Update

Priority MEDIUM 42

The Login/Signup Popup, Waitlist Woocommerce ( Back in stock notifier ), and Side Cart Woocommerce (Ajax) WordPress plugins by XootiX are vulnerable to Cross-Site Request Forgery via the save_settings function found in t…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00817 Published 2022-01-18 No fix listed CWE-352
TI-2020-18886 CVE-2020-36715 · GHSA-98xf-q552-97w3

Login/Signup Popup < 1.5 - Missing Authorization

Priority LOW 34

The Login/Signup Popup plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on several functions in versions up to, and including, 1.4.

CVSS 3.1HIGH 7.4 Network Low privileges No interaction EPSS 0.00697 Published 2023-06-07 Fixed in 1.5 CWE-862
TI-2025-00903 CVE-2025-1064 · GHSA-jj4m-28mq-gpjr

Cross-site scripting in xootix Login & Register Customizer – Popup | Slider | Inline |…

Priority LOW 28

The Login/Signup Popup ( Inline Form + Woocommerce ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's xoo_el_action shortcode in all versions up to, and including, 2.8.5 due to insuffici…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00279 Published 2025-02-20 No fix listed CWE-79
TI-2024-05260 CVE-2024-5665 · GHSA-fj7x-4jpw-qx69

Login/Signup Popup ( Inline Form + Woocommerce ) 2.7.1 - 2.7.2 - Missing Authorization to Arbitrary Options Exposure

Priority LOW 20

The Login/Signup Popup ( Inline Form + Woocommerce ) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ‘export_settings’ function in versions 2.7.1 to 2.7.2.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00362 Published 2024-06-06 No fix listed CWE-862
Open these records in search →