The WordPress plugin HANDMADE – Dropshipping for Etsy and WooCommerce up to version 1.0.10 lacks a proper authorization check (CWE-862). According to the CVE record, an authenticated user with low privileges may be able to perform actions they should not be allowed to, which could affect the availability and integrity of data in the WooCommerce shop. The CVSS score is 7.1 (High), but the exact vulnerable function and required privilege level are not documented in the sources reviewed.
VillaTheme · HANDMADE – Dropshipping for Etsy and WooCommerce
VillaTheme Salevo (WordPress plugin woo-boost-sales) up to and including version 1.3.0 contains a code injection flaw (CWE-94). According to the CNA's CVSS 3.1 vector, an unauthenticated remote attacker could exploit it over the network without user interaction, with high confidentiality impact. The description is vague and does not name the affected component, and the vector is questionable for a code injection flaw, so the actual impact is not fully confirmed.
VillaTheme · Salevo
Email Template Customizer for WooCommerce, a WordPress plugin by VillaTheme, contains a code injection vulnerability (CWE-94) in versions up to and including 1.3.4. According to the CNA vector, an unauthenticated attacker over the network could inject content that is then processed, potentially allowing unwanted content such as ads, scam or malware links on the site. The exact preconditions and the vulnerable function could not be verified from the advisory.
VillaTheme · Email Template Customizer for WooCommerce
The WordPress plugin AFFI – Affiliate Marketing for WooCommerce up to and including version 1.0.10 deserializes untrusted data, which allows PHP Object Injection. According to the CNA, an unauthenticated attacker can exploit this over the network with low complexity and no user interaction, which may allow manipulation of server-side processing and high impact on confidentiality, integrity and availability. The vendor changelog indicates that the fix in version 1.0.11 replaces PHP serialization with signed JSON for referral cookies.
VillaTheme · AFFI – Affiliate Marketing for WooCommerce
The WordPress plugin Thank You Page Customizer for WooCommerce up to and including version 1.2.3 contains a code injection flaw (CWE-94) that allows content injection on the order thank-you page. According to Patchstack, an attacker can add unwanted content such as ads, scam text or malware links to affected pages. The CVSS 3.1 score is 7.5 with no privileges and no user interaction required, but the impact is listed as confidentiality only. Version 1.2.4 fixes the issue.
VillaTheme · Thank You Page Customizer for WooCommerce
The Photo Reviews for WooCommerce WordPress plugin up to and including version 1.2.30 does not sanitize or escape the 'wcpr_image_upload_id' parameter. An unauthenticated visitor can store a script in review comment meta, which is not filtered by wp_kses, and it runs in the browser of anyone who views the affected review. The only gate is a nonce that is printed on every product review form, and no authentication or ownership check is performed.
VillaTheme · Photo Reviews for WooCommerce
The WordPress plugin Photo Reviews for WooCommerce stores attacker-supplied post IDs with customer review submissions and does not check that they belong to the submitter. When an administrator later deletes that review, or WordPress empties the comment trash after 30 days, the plugin permanently deletes every stored post ID. An unauthenticated visitor can therefore cause the loss of posts, pages, products or media attachments, but the flaw does not expose confidential data. The attack requires that a review is deleted, which happens during routine moderation.
VillaTheme · Photo Reviews for WooCommerce
Photo Reviews for WooCommerce up to and including version 1.2.30 contains an insecure direct object reference (CWE-639). According to Patchstack, an unauthenticated remote attacker can change an ID in a request and expose other people's data, while the CVSS vector rates only the availability impact (A:H). The attack requires no login and no user interaction, so public WooCommerce shops running the plugin are exposed.
VillaTheme · Photo Reviews for WooCommerce
The WordPress plugin BuildKit – Product Builder for WooCommerce – Custom PC Builder up to and including version 1.0.28 contains a blind SQL injection flaw. An attacker with low-privilege access to the WordPress site, such as a contributor-level account, may be able to read, modify or delete database content, including user and customer data. The NVD analysis is still pending and the vendor has not yet confirmed the mapping of this CVE to the fix in version 1.0.29.
VillaTheme · BuildKit – Product Builder for WooCommerce
