Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

2 records

Vendor: VillaTheme Component: Orders Tracking For Woocommerce Clear all filters
TI-2023-03903 CVE-2023-4216 · GHSA-86mp-73cw-r9x3

Orders Tracking for WooCommerce < 1.2.6 - Admin+ Arbitrary File Access/Read

Priority MEDIUM 47

The Orders Tracking for WooCommerce WordPress plugin before 1.2.6 doesn't validate the file_url parameter when importing a CSV file, allowing high privilege users with the manage_woocommerce capability to access any file…

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00665 Published 2023-09-04 Fixed in 1.2.6
TI-2021-07340 CVE-2021-25062 · GHSA-hhcq-vjf5-gv22

Orders Tracking for WooCommerce < 1.1.10 - Reflected Cross-Site Scripting

Priority LOW 29

The Orders Tracking for WooCommerce WordPress plugin before 1.1.10 does not sanitise and escape the file_url before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00887 Published 2022-01-24 Fixed in 1.1.10 CWE-79