WooCommerce Cross-Site Request Forgery (CSRF)

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2019-20891 · ADVISORY
• woocommerce/woocommerce commit fd7feb7 · WEB
• blog.ripstech.com/2019/woocommerce-csrf-to-stored-xss · WEB
• woocommerce/woocommerce · PACKAGE
• raw.githubusercontent.com/woocommerce/woocommerce/master/CHANGELOG.txt · WEB
• blog.ripstech.com/2019/woocommerce-csrf-to-stored-xss · Third Party Advisory

woocommerce/woocommerce のその他の脆弱性

• CVE-2024-37297中 5.4WooCommerce is an open-source e-commerce platform built on WordPress. A vulnerability introduced in WooCommerce 8.8 allows for cross-site sc…
• CVE-2022-2099中 4.8The WooCommerce WordPress plugin before 6.6.0 is vulnerable to stored HTML injection due to lack of escaping and sanitizing in the payment g…
• CVE-2021-24323中 4.8When taxes are enabled, the "Additional tax classes" field was not properly sanitised or escaped before being output back in the admin dashb…
• CVE-2020-29156中 5.3The WooCommerce plugin before 4.7.0 for WordPress allows remote attackers to view the status of arbitrary orders via the order_id parameter …