xootix

4 results · Clear filters · Feed

• High 8.8
  CVE-2024-5324 Public exploit

  XootiX Framework <= Various Plugin Versions - Missing Authorization to Arbitrary Options Update

  Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the 'import_settings' function in various versions. This makes it possible for authenticated attackers, with…

  xootix Waitlist Woocommerce ( Back in stock notifier ) OTP Login & Register Woocommerce Login & Register Customizer – Popup | Slider | Inline | WooCommerce Web / CMS
  Jun 6, 2024
• High 7.4
  CVE-2020-36715

  Login/Signup Popup < 1.5 - Missing Authorization

  The Login/Signup Popup plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on several functions in versions up to, and including, 1.4. This makes it possible for authenticated attackers to inject arbitrary web scripts i…

  xootix Login & Register Customizer – Popup | Slider | Inline | WooCommerce Web / CMS
  Jun 7, 2023
• High 8.1
  CVE-2023-2706

  OTP Login Woocommerce & Gravity Forms <= 2.2 - Authentication Bypass to Privilege Escalation

  The OTP Login Woocommerce & Gravity Forms plugin for WordPress is vulnerable to authentication bypass. This is due to the fact that when generating OTP codes for users to use in order to login via phone number, the plugin returns these codes in an AJAX respon…

  xootix OTP Login & Register Woocommerce Web / CMS
  May 17, 2023
• High 8.8
  CVE-2022-0215

  XootiX Plugins <= Various Versions Cross-Site Request Forgery to Arbitrary Options Update

  The Login/Signup Popup, Waitlist Woocommerce ( Back in stock notifier ), and Side Cart Woocommerce (Ajax) WordPress plugins by XootiX are vulnerable to Cross-Site Request Forgery via the save_settings function found in the ~/includes/xoo-framework/admin/class…

  xootix Waitlist Woocommerce ( Back in stock notifier ) Side Cart Woocommerce (Ajax) Login/Signup Popup Web / CMS
  Jan 18, 2022