Vulnerabilities

TI-2024-04943 CVE-2024-5324 · GHSA-764x-99q3-75x3

XootiX Framework <= Various Plugin Versions - Missing Authorization to Arbitrary Options Update

MEDIUM 43

Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the 'import_settings' function in various versions.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01507 Published 2024-06-06 No fix listed CWE-862

TI-2023-12960 CVE-2023-28415 · GHSA-jfw7-rc67-m9q7

WordPress Side Cart Woocommerce (Ajax) Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS)

LOW 27

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in XootiX Side Cart Woocommerce (Ajax) plugin <= 2.2 versions.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00506 Published 2023-08-30 No fix listed CWE-79

TI-2022-22342 CVE-2022-45376 · GHSA-4wg8-rfwp-7xcc

WordPress Side Cart Woocommerce (Ajax) Plugin < 2.1 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in XootiX Side Cart Woocommerce (Ajax) < 2.1 versions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00273 Published 2023-05-22 Fixed in 2.1 CWE-352

TI-2022-00152 CVE-2022-0215 · GHSA-824x-r58x-c6fc

XootiX Plugins <= Various Versions Cross-Site Request Forgery to Arbitrary Options Update

MEDIUM 42

The Login/Signup Popup, Waitlist Woocommerce ( Back in stock notifier ), and Side Cart Woocommerce (Ajax) WordPress plugins by XootiX are vulnerable to Cross-Site Request Forgery via the save_settings function found in t…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00817 Published 2022-01-18 No fix listed CWE-352

Vulnerabilities

Filters

XootiX Framework <= Various Plugin Versions - Missing Authorization to Arbitrary Options Update

WordPress Side Cart Woocommerce (Ajax) Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS)

WordPress Side Cart Woocommerce (Ajax) Plugin < 2.1 is vulnerable to Cross Site Request Forgery (CSRF)

XootiX Plugins <= Various Versions Cross-Site Request Forgery to Arbitrary Options Update