Vulnerabilities

TI-2024-24725 CVE-2024-37210 · GHSA-xf32-v42j-x7mg

WordPress AliExpress Dropshipping with AliNext Lite plugin <= 3.3.5 - Broken Access Control vulnerability

LOW 28

Missing Authorization vulnerability in ali2woo AliNext allows Exploiting Incorrectly Configured Access Control Security Levels.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00269 Published 2026-06-17 No fix listed CWE-862

TI-2024-24726 CVE-2024-37211 · GHSA-cvr6-66wr-f2c5

WordPress AliExpress Dropshipping with AliNext Lite plugin <= 3.3.5 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ali2Woo Team Ali2Woo Lite allows Reflected XSS.This issue affects Ali2Woo Lite: from n/a through 3.3.5.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00272 Published 2024-07-22 No fix listed CWE-79

TI-2024-24727 CVE-2024-37212 · GHSA-fr2r-x4wp-q45h

WordPress AliExpress Dropshipping with AliNext Lite plugin <= 3.3.5 - CSRF to PHP Object Injection vulnerability

LOW 39

Cross-Site Request Forgery (CSRF) vulnerability in Ali2Woo Ali2Woo Lite.This issue affects Ali2Woo Lite: from n/a through 3.3.5.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0021 Published 2024-06-21 No fix listed CWE-352

TI-2024-02212 CVE-2024-2381 · GHSA-vf9x-9xc7-h8c7

AliExpress Dropshipping with AliNext Lite <= 3.3.5 - Authenticated (Subscriber+) Arbitrary File Upload

MEDIUM 42

The AliExpress Dropshipping with AliNext Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_save_image function in all versions up to, and including, 3.3.5.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00912 Published 2024-06-19 No fix listed CWE-434

TI-2024-04140 CVE-2024-4450 · GHSA-j553-72x4-g3hq

AliExpress Dropshipping with AliNext Lite <= 3.3.6 - Missing Authorization via Several Functions