wp-ecommerce vulnerabilities

Products

• easy wp smtp 8
• recurring paypal donations 1
• wp ecommerce 1
• wp-e-commerce 1

Latest wp-ecommerce CVEs

Newest publication first

1. CVE-2024-3073 Easy WP SMTP by SendLayer <= 2.3.0 - Exposure of Sensitive Information via the UI

   Published 2024-06-13

   Low·CVSS 2.7 EPSS 0.33%

   The Easy WP SMTP by SendLayer – WordPress SMTP and Email Log Plugin plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 2.3.0. This is due to plugin providing the SMTP password in the SMTP Password field when viewing the settings. This...

2. CVE-2024-35676 WordPress Recurring PayPal Donations plugin <= 1.7 - Cross Site Scripting (XSS) vulnerability

   Published 2024-06-08

   Medium·CVSS 5.4 EPSS 0.25%

   Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in wpecommerce Recurring PayPal Donations allows Stored XSS.This issue affects Recurring PayPal Donations: from n/a through 1.7.

3. CVE-2024-1516 WP eCommerce <= 3.15.1 - Missing Authorization to Unauthenticated Arbitrary Post Creation

   Published 2024-02-28

   Medium·CVSS 5.3 EPSS 0.42%

   The WP eCommerce plugin for WordPress is vulnerable to unauthorized arbitrary post creation due to a missing capability check on the check_for_saas_push() function in all versions up to, and including, 3.15.1. This makes it possible for unauthenticated attackers to create arbitra...

4. CVE-2024-1514 WP eCommerce <= 3.15.1 - Unauthenticated SQL Injection

   Published 2024-02-28

   High·CVSS 7.5 EPSS 0.72%

   The WP eCommerce plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'cart_contents' parameter in all versions up to, and including, 3.15.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

5. CVE-2019-25141 Easy WP SMTP <= 1.3.9 - Missing Authorization to Arbitrary Options Update

   Published 2023-06-07

   Critical·CVSS 9.8 EPSS 4.5%

   The Easy WP SMTP plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.3.9. This is due to missing capability checks on the admin_init() function, in addition to insufficient input validation. This makes it possible for unauthenticated att...

6. CVE-2022-42699 WordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Remote Code Execution (RCE)

   Published 2022-12-06

   High·CVSS 8.8 EPSS 1.5%

   Auth. Remote Code Execution vulnerability in Easy WP SMTP plugin <= 1.5.1 on WordPress.

7. CVE-2022-45829 WordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Arbitrary File Deletion

   Published 2022-12-06

   High·CVSS 8.1 EPSS 0.91%

   Auth. Path Traversal vulnerability in Easy WP SMTP plugin <= 1.5.1 at WordPress.

8. CVE-2022-45833 WordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Directory Traversal

   Published 2022-12-06

   Medium·CVSS 6.5 EPSS 0.87%

   Auth. Path Traversal vulnerability in Easy WP SMTP plugin <= 1.5.1 on WordPress.

9. CVE-2022-3334 Easy WP SMTP < 1.5.0 - Admin+ PHP Objection Injection

   Published 2022-10-31

   High·CVSS 7.2 EPSS 1.5%

   The Easy WP SMTP WordPress plugin before 1.5.0 unserialises the content of an imported file, which could lead to PHP object injection issue when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.

10. CVE-2020-35234 Easy WP SMTP <= 1.4.2 - Sensitive Information Disclosure

    Published 2020-12-14

    High·CVSS 7.5 EPSS 60.4%

    The easy-wp-smtp plugin before 1.4.4 for WordPress allows Administrator account takeover, as exploited in the wild in December 2020. If an attacker can list the wp-content/plugins/easy-wp-smtp/ directory, then they can discover a log file (such as #############_debug_log.txt) tha...

11. CVE-2017-7723 Easy WP SMTP <= 1.2.4 - Cross-Site Scripting

    Published 2017-04-24

    Medium·CVSS 6.1 EPSS 0.78%

    XSS exists in Easy WP SMTP (before 1.2.5), a WordPress Plugin, via the e-mail subject or body.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.