Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

5 records

Vendor: Automattic Component: Woopayments Clear all filters
TI-2023-28155 CVE-2023-51503 · GHSA-mg36-6hj2-xj8q

WordPress WooCommerce Payments Plugin <= 6.6.2 is vulnerable to Insecure Direct Object References (IDOR)

Priority LOW 33

Authorization Bypass Through User-Controlled Key vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully Integrated Solution Built and Support…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00464 Published 2023-12-31 No fix listed CWE-639
TI-2023-17980 CVE-2023-35915 · GHSA-m6qj-fx7x-v24r

WordPress WooCommerce Payments Plugin <= 5.9.0 is vulnerable to SQL Injection

Priority MEDIUM 43

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully I…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00673 Published 2023-12-20 No fix listed CWE-89
TI-2023-17981 CVE-2023-35916 · GHSA-3vcv-r276-ff59

WordPress WooCommerce Payments Plugin <= 5.9.0 is vulnerable to Insecure Direct Object References (IDOR)

Priority LOW 34

Authorization Bypass Through User-Controlled Key vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully Integrated Solution Built and Support…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00565 Published 2023-12-20 No fix listed CWE-639
TI-2023-27232 CVE-2023-49828 · GHSA-9277-mg3f-fmc2

WordPress WooCommerce Payments Plugin <= 6.4.2 is vulnerable to Cross Site Scripting (XSS)

Priority LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo allows Stored XSS.This issue affects Woo…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00384 Published 2023-12-14 No fix listed CWE-79
TI-2023-12700 CVE-2023-28121 · GHSA-rw6j-4w4v-pm7m

Improper authentication in WooCommerce Payments WordPress Plugin

Priority HIGH 84

An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.87448 Published 2023-04-12 No fix listed CWE-287