Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

9 records

Vendor: ZAYTECH Component: Smart Online Order For Clover Clear all filters
TI-2024-08153 CVE-2024-8787 · GHSA-w82w-f949-p24g

Smart Online Order for Clover <= 1.5.7 - Reflected Cross-Site Scripting

Priority LOW 27

The Smart Online Order for Clover plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00395 Published 2024-10-16 No fix listed CWE-79
TI-2024-09181 CVE-2024-9895 · GHSA-f3r2-7c2h-8qpf

Cross-site scripting in ZAYTECH Smart Online Order for Clover

Priority LOW 28

The Smart Online Order for Clover plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's moo_receipt_link shortcode in all versions up to, and including, 1.5.7 due to insufficient input saniti…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00363 Published 2024-10-15 No fix listed CWE-79
TI-2024-06526 CVE-2024-7032 · GHSA-qf9m-88xv-jvjp

Smart Online Order for Clover <= 1.5.6 - Missing Authorization to Plugin Deactivation and Data Deletion

Priority LOW 35

The Smart Online Order for Clover plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'moo_deactivateAndClean' function in all versions up to, and including, 1.5.6.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00478 Published 2024-08-21 No fix listed CWE-862
TI-2024-06524 CVE-2024-7030 · GHSA-qwpw-6834-mmhg

Smart Online Order for Clover <= 1.5.6 - Missing Authorization to Authenticated (Subscriber+) Plugin Data Update

Priority LOW 20

The Smart Online Order for Clover plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 1.5.6.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0035 Published 2024-08-21 No fix listed CWE-862
TI-2024-19289 CVE-2024-29115 · GHSA-6w38-pjgp-4rf7

WordPress Smart Online Order for Clover plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability

Priority LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zaytech Smart Online Order for Clover allows Stored XSS.This issue affects Smart Online Order for Clover: from n/a thr…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00337 Published 2024-03-19 No fix listed CWE-79