xootix

Records15All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high5CVSS 7.0–8.9

Exploited now

xootix records in CISA KEV

No xootix vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Login/signup Popup 5 records MEDIUM Side Cart Woocommerce 4 records MEDIUM Waitlist Woocommerce 3 records MEDIUM Otp Login Woocommerce & Gravity Forms 2 records MEDIUM

Records

3 records in Waitlist Woocommerce · all components

TI-2024-04943 CVE-2024-5324 · GHSA-764x-99q3-75x3

XootiX Framework <= Various Plugin Versions - Missing Authorization to Arbitrary Options Update

MEDIUM 43

Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the 'import_settings' function in various versions.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01507 Published 2024-06-06 No fix listed CWE-862

TI-2022-00152 CVE-2022-0215 · GHSA-824x-r58x-c6fc

XootiX Plugins <= Various Versions Cross-Site Request Forgery to Arbitrary Options Update

MEDIUM 42

The Login/Signup Popup, Waitlist Woocommerce ( Back in stock notifier ), and Side Cart Woocommerce (Ajax) WordPress plugins by XootiX are vulnerable to Cross-Site Request Forgery via the save_settings function found in t…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00817 Published 2022-01-18 No fix listed CWE-352

TI-2024-08093 CVE-2024-8724 · GHSA-rhpc-qcxc-cfwf

Waitlist Woocommerce ( Back in stock notifier ) <= 2.7.5 - Reflected Cross-Site Scripting

LOW 27

The Waitlist Woocommerce ( Back in stock notifier ) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00375 Published 2024-09-14 No fix listed CWE-79

Open these records in search →

Critical	0
High	5
Medium	10
Low	0
No CVSS	0