WooCommerce Vulnerabilities and Affected Products
Vulnerabilities associated with AutomateWoo.
Products
Clear product- AutomateWoo5 vulnerabilities
- WooCommerce Stripe Payment Gateway5 vulnerabilities
- woocommerce_customers_manager5 vulnerabilities
- woocommerce4 vulnerabilities
- Product Vendors3 vulnerabilities
- Shipping Multiple Addresses3 vulnerabilities
- WooCommerce PayPal Payments3 vulnerabilities
- Product Add-Ons2 vulnerabilities
- WooCommerce Bookings2 vulnerabilities
- WooCommerce Box Office2 vulnerabilities
- WooCommerce Brands2 vulnerabilities
- WooCommerce Follow-Up Emails (AutomateWoo)2 vulnerabilities
- WooCommerce Pre-Orders2 vulnerabilities
- WooCommerce Square2 vulnerabilities
- box_office1 vulnerability
- Bulk Stock Management1 vulnerability
- Canada Post Shipping Method1 vulnerability
- checkout_field_editor1 vulnerability
- Composite Products1 vulnerability
- dropshipping1 vulnerability
- GoCardless1 vulnerability
- Google for WooCommerce1 vulnerability
- help_scout1 vulnerability
- Order Delivery Date Pro1 vulnerability
- persian-woocommerce1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2023-33318CRITICAL | WordPress WooCommerce Follow-Up Emails Plugin <= 4.9.40 is vulnerable to Arbitrary File UploadUnrestricted Upload of File with Dangerous Type vulnerability in WooCommerce AutomateWoo.This issue affects AutomateWoo: from n/a through 4.9.40. CWE-434Dec 20, 2023 | CVSS9.9v3.1 | EPSS0.814% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-32743HIGH | WordPress AutomateWoo Plugin <= 5.7.1 is vulnerable to SQL InjectionImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce AutomateWoo.This issue affects AutomateWoo: from n/a through 5.7.1. CWE-89Dec 20, 2023 | CVSS7.6v3.1 | EPSS0.615% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-33330HIGH | WordPress WooCommerce Follow-Up Emails Plugin <= 4.9.50 is vulnerable to SQL InjectionImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce AutomateWoo.This issue affects AutomateWoo: from n/a through 4.9.50. CWE-89Dec 20, 2023 | CVSS8.5v3.1 | EPSS0.644% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-32745MEDIUM | WordPress AutomateWoo Plugin <= 5.7.1 is vulnerable to Cross Site Request Forgery (CSRF)Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce AutomateWoo plugin <= 5.7.1 versions. CWE-352Nov 9, 2023 | CVSS5.4v3.1 | EPSS0.303% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-36513MEDIUM | WordPress AutomateWoo Plugin <= 5.7.5 is vulnerable to Cross Site Request Forgery (CSRF)Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce AutomateWoo plugin <= 5.7.5 versions. CWE-352Jul 17, 2023 | CVSS5.4v3.1 | EPSS0.248% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |