WordPress Plugin Vulnerabilities

Wholesale Suite < 2.1.5.1 - Cross-Site Request Forgery

Description

The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks.

Affects Plugins

Plugin icon
woocommerce-wholesale-prices
Fixed in 2.1.5.1

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.3 (medium)

Miscellaneous

Verified
No
WPVDB ID
f087eb3d-a124-4311-bfc0-9b11b9df0cf0

Timeline

Publicly Published
2023-05-09 (about 3 years ago)
Added
2023-05-09 (about 3 years ago)
Last Updated
2023-05-09 (about 3 years ago)

Other

Published
Title
Published
2021-10-15
Title
WordPress + Microsoft Office 365 < 15.4 - Unauthenticated Stored Cross-Site Scripting
Published
2024-10-29
Title
Widget or Sidebar Shortcode <= 0.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published
2024-11-01
Title
Elo Rating Shortcode < 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-01-16
Title
REDIRECTION PLUS <= 2.0.0 - Reflected Cross-Site Scripting
Published
2024-12-19
Title
Spoki < 2.15.16 - Contributor+ Stored XSS