Vulnerabilities > Wpfactory

DATE CVE VULNERABILITY TITLE RISK
2023-12-29 CVE-2023-51399 Cross-site Scripting vulnerability in Wpfactory Back Button Widget
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Back Button Widget allows Stored XSS.This issue affects Back Button Widget: from n/a through 1.6.3.
network
low complexity
wpfactory CWE-79
5.4
2023-11-14 CVE-2023-47547 Cross-site Scripting vulnerability in Wpfactory Products, Order & Customers Export for Woocommerce
Unauth.
network
low complexity
wpfactory CWE-79
6.1
2023-10-20 CVE-2021-4418 Cross-Site Request Forgery (CSRF) vulnerability in Wpfactory Custom Css, JS & PHP 2.0.7
The Custom CSS, JS & PHP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.7.
network
low complexity
wpfactory CWE-352
4.3
2023-10-20 CVE-2023-4947 Missing Authorization vulnerability in Wpfactory EAN for Woocommerce
The WooCommerce EAN Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the refresh_order_ean_data AJAX action in versions up to 6.1.0.
network
low complexity
wpfactory CWE-862
4.3
2023-08-05 CVE-2023-36689 Cross-site Scripting vulnerability in Wpfactory Helper
Unauth.
network
low complexity
wpfactory CWE-79
6.1
2023-06-19 CVE-2023-2684 Unspecified vulnerability in Wpfactory File Renaming on Upload
The File Renaming on Upload WordPress plugin before 2.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
network
low complexity
wpfactory
4.8
2023-02-06 CVE-2023-0062 Unspecified vulnerability in Wpfactory EAN for Woocommerce
The EAN for WooCommerce WordPress plugin before 4.4.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
network
low complexity
wpfactory
5.4
2019-10-07 CVE-2019-17239 Cross-site Scripting vulnerability in Wpfactory Download Plugins and Themes From Dashboard
includes/settings/class-alg-download-plugins-settings.php in the download-plugins-dashboard plugin through 1.5.0 for WordPress has multiple unauthenticated stored XSS issues.
network
wpfactory CWE-79
4.3