Vulnerabilities and security researches forwaitlist-woocommerce waitlist-woocommerce

Jun 06, 2024

CVE, Research URL: CVE-2022-0215
Home page URL: Security reports for Waitlist Woocommerce ( Back in stock notifier )
Application: Waitlist Woocommerce ( Back in stock notifier )
Date: Jan 18, 2022
Research Description: The Login/Signup Popup, Waitlist Woocommerce ( Back in stock notifier ), and Side Cart Woocommerce (Ajax) WordPress plugins by XootiX are vulnerable to Cross-Site Request Forgery via the save_settings function found in the ~/includes/xoo-framework/admin/class-xoo-admin-settings.php file which makes it possible for attackers to update arbitrary options on a site that can be used to create an administrative user account and grant full privileged access to a compromised site. This affects versions <= 2.2 in Login/Signup Popup, versions <= 2.5.1 in Waitlist Woocommerce ( Back in stock notifier ), and versions <= 2.0 in Side Cart Woocommerce (Ajax).
Affected versions: max 2.5.2.
Status: vulnerable

Aug 12, 2024

CVE, Research URL: CVE-2024-43134
Home page URL: Security reports for Waitlist Woocommerce ( Back in stock notifier )
Application: Waitlist Woocommerce ( Back in stock notifier )
Date: Nov 01, 2024
Research Description: Missing Authorization vulnerability in xootix Waitlist Woocommerce ( Back in stock notifier ) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Waitlist Woocommerce ( Back in stock notifier ): from n/a through 2.6.
Affected versions: max 2.6.1.
Status: vulnerable

Sep 15, 2024

CVE, Research URL: CVE-2024-8724
Home page URL: Security reports for Waitlist Woocommerce ( Back in stock notifier )
Application: Waitlist Woocommerce ( Back in stock notifier )
Date: Sep 14, 2024
Research Description: The Waitlist Woocommerce ( Back in stock notifier ) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.7.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected versions: max 2.7.6.
Status: vulnerable