Vulnerabilities

TI-2025-00903 CVE-2025-1064 · GHSA-jj4m-28mq-gpjr

Cross-site scripting in xootix Login & Register Customizer – Popup | Slider | Inline |…

LOW 28

The Login/Signup Popup ( Inline Form + Woocommerce ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's xoo_el_action shortcode in all versions up to, and including, 2.8.5 due to insuffici…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00279 Published 2025-02-20 No fix listed CWE-79

TI-2024-05260 CVE-2024-5665 · GHSA-fj7x-4jpw-qx69

Login/Signup Popup ( Inline Form + Woocommerce ) 2.7.1 - 2.7.2 - Missing Authorization to Arbitrary Options Exposure

LOW 20

The Login/Signup Popup ( Inline Form + Woocommerce ) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ‘export_settings’ function in versions 2.7.1 to 2.7.2.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00362 Published 2024-06-06 No fix listed CWE-862

TI-2024-04943 CVE-2024-5324 · GHSA-764x-99q3-75x3

XootiX Framework <= Various Plugin Versions - Missing Authorization to Arbitrary Options Update

MEDIUM 43

Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the 'import_settings' function in various versions.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01507 Published 2024-06-06 No fix listed CWE-862

TI-2020-18886 CVE-2020-36715 · GHSA-98xf-q552-97w3

Login/Signup Popup < 1.5 - Missing Authorization

LOW 34

The Login/Signup Popup plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on several functions in versions up to, and including, 1.4.

CVSS 3.1HIGH 7.4 Network Low privileges No interaction EPSS 0.00697 Published 2023-06-07 Fixed in 1.5 CWE-862

TI-2022-00152 CVE-2022-0215 · GHSA-824x-r58x-c6fc

XootiX Plugins <= Various Versions Cross-Site Request Forgery to Arbitrary Options Update

MEDIUM 42

The Login/Signup Popup, Waitlist Woocommerce ( Back in stock notifier ), and Side Cart Woocommerce (Ajax) WordPress plugins by XootiX are vulnerable to Cross-Site Request Forgery via the save_settings function found in t…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00817 Published 2022-01-18 No fix listed CWE-352