Skip to content

Vendor

woothemes vulnerabilities

4 published CVES affecting woothemes, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
4
Critical
0
High
1
Medium
3
Low
0
Unscored
0
CISA KEV
0
Atom feed of woothemes alerts

Products

Latest woothemes CVEs

Newest publication first

  1. CVE-2019-25779 WooThemes Diarise 1.5.9 Local File Disclosure via download.php

    Published
    HighCVSS 8.7 EPSS 0.45%

    WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary files through the calendar parameter of download.php. Attackers can send GET requests with file:// scheme paths to the calendar parameter to disclose sensiti...

  2. CVE-2024-9944 WooCommerce <= 9.0.2 - Unauthenticated HTML Injection

    Published
    MediumCVSS 6.1 EPSS 0.59%

    The WooCommerce plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 9.0.2. This is due to the plugin not properly neutralizing HTML elements from submitted order forms. This makes it possible for unauthenticated attackers to inject arbitrary...

  3. CVE-2015-2069 WooCommerce <= 2.2.10 - Cross-Site Scripting

    Published
    MediumCVSS 4.3 EPSS 2.0%

    Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.2.11 for WordPress allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING in the wc-reports page to wp-admin/admin.php.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.