Vulnerabilities

TI-2024-02158 CVE-2024-2322 · GHSA-rfj8-v7wf-3hfc

WooCommerce Cart Abandonment Recovery < 1.2.27 - Templates/Abandoned Orders Deletion via CSRF

MEDIUM 63

The WooCommerce Cart Abandonment Recovery WordPress plugin before 1.2.27 does not have CSRF check in its bulk actions, which could allow attackers to make logged in admins delete arbitrary email templates as well as dele…

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.00353 Published 2024-04-03 Fixed in 1.2.27 CWE-352

TI-2024-19589 CVE-2024-29813 · GHSA-mf26-xjpm-h3gp

WordPress CartFlows plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability

LOW 26

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CartFlows Inc.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00359 Published 2024-03-27 No fix listed CWE-79

TI-2023-18501 CVE-2023-36686 · GHSA-c69v-pxwp-r79x

WordPress CartFlows Pro Plugin <= 1.11.11 is vulnerable to Cross Site Scripting (XSS)

LOW 31

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CartFlows Pro plugin <= 1.11.11 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00382 Published 2023-08-05 No fix listed CWE-79

TI-2020-18905 CVE-2020-36736 · GHSA-w2pg-jphm-pj4r

Cross-site request forgery in Brainstorm Force CartFlows – Funnel Builder & Checkout…

LOW 20

The WooCommerce Checkout & Funnel Builder by CartFlows plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.15.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00458 Published 2023-07-01 Fixed in 1.5.16 CWE-352

TI-2019-15254 CVE-2019-25151 · GHSA-9658-g3fh-xgf8

Funnel Builder <= 1.3.0 - Arbitrary Plugin Activation

LOW 26

The Funnel Builder plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the activate_plugin function in versions up to, and including, 1.3.0.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00715 Published 2023-06-07 No fix listed CWE-269

TI-2021-06622 CVE-2021-24330 · GHSA-jpx9-hmgp-grj6

Funnel Builder by CartFlows < 1.6.13 - Authenticated Stored XSS via FB Pixel ID and Google Analytics ID

LOW 23

The Funnel Builder by CartFlows – Create High Converting Sales Funnels For WordPress plugin before 1.6.13 did not sanitise its facebook_pixel_id and google_analytics_id settings, allowing high privilege users to set XSS…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00652 Published 2021-06-01 Fixed in 1.6.13 CWE-79