Vulnerabilities

TI-2024-08093 CVE-2024-8724 · GHSA-rhpc-qcxc-cfwf

Waitlist Woocommerce ( Back in stock notifier ) <= 2.7.5 - Reflected Cross-Site Scripting

LOW 27

The Waitlist Woocommerce ( Back in stock notifier ) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00375 Published 2024-09-14 No fix listed CWE-79

TI-2024-04943 CVE-2024-5324 · GHSA-764x-99q3-75x3

XootiX Framework <= Various Plugin Versions - Missing Authorization to Arbitrary Options Update

MEDIUM 43

Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the 'import_settings' function in various versions.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01507 Published 2024-06-06 No fix listed CWE-862

TI-2022-00152 CVE-2022-0215 · GHSA-824x-r58x-c6fc

XootiX Plugins <= Various Versions Cross-Site Request Forgery to Arbitrary Options Update

MEDIUM 42

The Login/Signup Popup, Waitlist Woocommerce ( Back in stock notifier ), and Side Cart Woocommerce (Ajax) WordPress plugins by XootiX are vulnerable to Cross-Site Request Forgery via the save_settings function found in t…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00817 Published 2022-01-18 No fix listed CWE-352

Vulnerabilities

Filters

Waitlist Woocommerce ( Back in stock notifier ) <= 2.7.5 - Reflected Cross-Site Scripting

XootiX Framework <= Various Plugin Versions - Missing Authorization to Arbitrary Options Update

XootiX Plugins <= Various Versions Cross-Site Request Forgery to Arbitrary Options Update