Vulnerabilities > Pluginus > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-03-22 | CVE-2023-28666 | Cross-site Scripting vulnerability in Pluginus Inpost Gallery 2.1.4.1 The InPost Gallery WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'imgurl' parameter to the add_inpost_gallery_slide_item action, which can only be triggered by an authenticated user. | 5.4 |
| 2023-01-16 | CVE-2022-4431 | Unspecified vulnerability in Pluginus FOX - Currency Switcher Professional for Woocommerce The WOOCS WordPress plugin before 1.3.9.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. | 5.4 |
| 2022-06-27 | CVE-2022-1916 | Unspecified vulnerability in Pluginus Woot The Active Products Tables for WooCommerce. | 6.1 |
| 2022-02-21 | CVE-2022-0234 | Unspecified vulnerability in Pluginus Woocs The WOOCS WordPress plugin before 1.3.7.5 does not sanitise and escape the woocs_in_order_currency parameter of the woocs_get_products_price_html AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting | 6.1 |
| 2022-02-01 | CVE-2021-25085 | Unspecified vulnerability in Pluginus Woocommerce products Filter The WOOF WordPress plugin before 1.2.6.3 does not sanitise and escape the woof_redraw_elements before outputing back in an admin page, leading to a Reflected Cross-Site Scripting | 6.1 |
| 2022-01-10 | CVE-2021-25043 | Unspecified vulnerability in Pluginus Woocommerce Currency Switcher The WOOCS WordPress plugin before 1.3.7.3 does not sanitise and escape the custom_prices parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue | 6.1 |