Vulnerabilities > Xootix

DATE CVE VULNERABILITY TITLE RISK
2023-08-30 CVE-2023-28415 Cross-site Scripting vulnerability in Xootix Side Cart Woocommerce
Auth.
network
low complexity
xootix CWE-79
4.8
2023-06-07 CVE-2020-36715 Missing Authorization vulnerability in Xootix Login/Signup Popup
The Login/Signup Popup plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on several functions in versions up to, and including, 1.4.
network
low complexity
xootix CWE-862
4.6
2023-05-22 CVE-2022-45376 Cross-Site Request Forgery (CSRF) vulnerability in Xootix Side Cart Woocommerce 1.0.0/1.0.2/2.0
Cross-Site Request Forgery (CSRF) vulnerability in XootiX Side Cart Woocommerce (Ajax) < 2.1 versions.
network
low complexity
xootix CWE-352
8.8
2023-05-17 CVE-2023-2706 Improper Authentication vulnerability in Xootix OTP Login Woocommerce & Gravity Forms
The OTP Login Woocommerce & Gravity Forms plugin for WordPress is vulnerable to authentication bypass.
network
high complexity
xootix CWE-287
8.1
2022-01-18 CVE-2022-0215 Cross-Site Request Forgery (CSRF) vulnerability in Xootix products
The Login/Signup Popup, Waitlist Woocommerce ( Back in stock notifier ), and Side Cart Woocommerce (Ajax) WordPress plugins by XootiX are vulnerable to Cross-Site Request Forgery via the save_settings function found in the ~/includes/xoo-framework/admin/class-xoo-admin-settings.php file which makes it possible for attackers to update arbitrary options on a site that can be used to create an administrative user account and grant full privileged access to a compromised site.
network
xootix CWE-352
6.8