Filtered by vendor Woothemes Subscriptions
Total 3 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2015-2069 1 Woothemes 1 Woocommerce 2024-11-21 N/A
Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.2.11 for WordPress allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING in the wc-reports page to wp-admin/admin.php.
CVE-2014-6313 1 Woothemes 1 Woocommerce Plugin 2024-11-21 N/A
Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the range parameter on the wc-reports page to wp-admin/admin.php.
CVE-2024-9944 2 Woocommerce, Woothemes 2 Woocommerce, Woocommerce 2024-10-17 5.3 Medium
The WooCommerce plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 9.0.2. This is due to the plugin not properly neutralizing HTML elements from submitted order forms. This makes it possible for unauthenticated attackers to inject arbitrary HTML that will render when the administrator views order form submissions.