vanquish records

16 published records for vendor vanquish.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 5
With a fix record: 37.5%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

16 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
40Plan	CVE-2021-24171No exploit	WooCommerce Upload Files < 59.4 - Unauthenticated Arbitrary File Uploadvanquish · woocommerce upload files · CWE-434 Pre-auth Path traversal File upload	Critical9.8	—	1.8%	Apr 5, 2021
39Monitor	CVE-2024-11150No exploit	WordPress User Extra Fields <= 16.6 - Unauthenticated Arbitrary File Deletionvanquish · user extra fields · CWE-22 pre-auth RCE Path traversal	Critical9.8	—	1.3%	Nov 13, 2024
39Monitor	CVE-2024-10820No exploit	WooCommerce Upload Files <= 84.3 - Unauthenticated Arbitrary File Uploadvanquish · woocommerce upload files · CWE-434 pre-auth RCE File upload	Critical9.8	—	1.2%	Nov 13, 2024
39Monitor	CVE-2024-10627No exploit	WooCommerce Support Ticket System <= 17.7 - Unauthenticated Arbitrary File Uploadvanquish · woocommerce support ticket system · CWE-434 pre-auth RCE File upload	Critical9.8	—	0.8%	Nov 9, 2024
39Monitor	CVE-2024-10801No exploit	WordPress User Extra Fields <= 16.5 - Unauthenticated Arbitrary File Uploadvanquish · wordpress user extra fields · CWE-434 pre-auth RCE File upload	Critical9.8	—	0.8%	Nov 9, 2024
36Monitor	CVE-2024-10625No exploit	WooCommerce Support Ticket System <= 17.7 - Unauthenticated Arbitrary File Deletionvanquish · woocommerce support ticket system · CWE-22 pre-auth RCE Path traversal	Critical9.1	—	1.0%	Nov 9, 2024
35Monitor	CVE-2024-10800No exploit	WordPress User Extra Fields <= 16.6 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalationvanquish · user extra fields · CWE-862 Broken access control (IDOR)	High8.8	—	0.8%	Nov 13, 2024
35Monitor	CVE-2024-13343No exploit	WooCommerce Customers Manager <= 31.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalationvanquish · woocommerce customers manager · CWE-269	High8.8	—	0.4%	Feb 1, 2025
33Monitor	CVE-2024-0399Proof of concept	WooCommerce Customers Manager < 29.7 - Subscriber+ SQL Injectionvanquish · woocommerce customers manager · CWE-89 SQL injection	High8.1	—	2.8%	Apr 15, 2024
32Monitor	CVE-2024-10626No exploit	WooCommerce Support Ticket System <= 17.7 - Authenticated (Subscriber+) Arbitrary File Deletionvanquish · woocommerce support ticket system · CWE-22 RCE Path traversal	High8.1	—	0.9%	Nov 9, 2024
32Monitor	CVE-2024-3983No exploit	WooCommerce Customers Manager < 30.1 - Bulk Action via CSRFvanquish · woocommerce customers manager · CWE-352 Pre-auth CSRF	High8.1	—	0.3%	Aug 1, 2024
26Monitor	CVE-2024-1756No exploit	WooCommerce Customers Manager < 29.8 - Subscriber+ Email Disclosurevanquish · woocommerce customers manager · CWE-352 CSRF	Medium6.5	—	0.3%	Apr 24, 2024
26Monitor	CVE-2024-2843No exploit	WooCommerce Customers Manager < 30.1 - User Deletion via CSRFvanquish · woocommerce customers manager · CWE-352 Pre-auth CSRF	Medium6.5	—	0.2%	Aug 1, 2024
26Monitor	CVE-2024-1747No exploit	WooCommerce Customers Manager < 30.2 - Subscriber+ Stored XSSvanquish · woocommerce customers manager · CWE-352 XSS CSRF	Medium6.5	—	0.1%	Aug 1, 2024
23Monitor	CVE-2024-1743No exploit	WooCommerce Customers Manager < 29.8 - Reflected XSSvanquish · woocommerce customers manager · CWE-79 Local privilege escalation XSS	Medium5.9	—	0.3%	Apr 24, 2024
21Monitor	CVE-2024-13775No exploit	WooCommerce Support Ticket System <= 17.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Information Exposurevanquish · woocommerce support ticket system · CWE-862 Broken access control (IDOR)	Medium5.4	—	0.2%	Feb 1, 2025

CVE-2021-24171
40Plan
WooCommerce Upload Files < 59.4 - Unauthenticated Arbitrary File Upload
CriticalCVSS 9.8No exploitEPSS 1%
vanquish · woocommerce upload filesApr 5, 2021
CVE-2024-11150
39Monitor
WordPress User Extra Fields <= 16.6 - Unauthenticated Arbitrary File Deletion
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- Path traversal
vanquish · user extra fieldsNov 13, 2024
CVE-2024-10820
39Monitor
WooCommerce Upload Files <= 84.3 - Unauthenticated Arbitrary File Upload
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- File upload
vanquish · woocommerce upload filesNov 13, 2024
CVE-2024-10627
39Monitor
WooCommerce Support Ticket System <= 17.7 - Unauthenticated Arbitrary File Upload
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- File upload
vanquish · woocommerce support ticket systemNov 9, 2024
CVE-2024-10801
39Monitor
WordPress User Extra Fields <= 16.5 - Unauthenticated Arbitrary File Upload
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- File upload
vanquish · wordpress user extra fieldsNov 9, 2024
CVE-2024-10625
36Monitor
WooCommerce Support Ticket System <= 17.7 - Unauthenticated Arbitrary File Deletion
CriticalCVSS 9.1No exploitEPSS 1%
- pre-auth RCE
- Path traversal
vanquish · woocommerce support ticket systemNov 9, 2024
CVE-2024-10800
35Monitor
WordPress User Extra Fields <= 16.6 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
HighCVSS 8.8No exploitEPSS 0%
- Broken access control (IDOR)
vanquish · user extra fieldsNov 13, 2024
CVE-2024-13343
35Monitor
WooCommerce Customers Manager <= 31.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
HighCVSS 8.8No exploitEPSS 0%
vanquish · woocommerce customers managerFeb 1, 2025
CVE-2024-0399
33Monitor
WooCommerce Customers Manager < 29.7 - Subscriber+ SQL Injection
HighCVSS 8.1Proof of conceptEPSS 2%
- SQL injection
vanquish · woocommerce customers managerApr 15, 2024
CVE-2024-10626
32Monitor
WooCommerce Support Ticket System <= 17.7 - Authenticated (Subscriber+) Arbitrary File Deletion
HighCVSS 8.1No exploitEPSS 0%
- RCE
- Path traversal
vanquish · woocommerce support ticket systemNov 9, 2024
CVE-2024-3983
32Monitor
WooCommerce Customers Manager < 30.1 - Bulk Action via CSRF
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- CSRF
vanquish · woocommerce customers managerAug 1, 2024
CVE-2024-1756
26Monitor
WooCommerce Customers Manager < 29.8 - Subscriber+ Email Disclosure
MediumCVSS 6.5No exploitEPSS 0%
- CSRF
vanquish · woocommerce customers managerApr 24, 2024
CVE-2024-2843
26Monitor
WooCommerce Customers Manager < 30.1 - User Deletion via CSRF
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
- CSRF
vanquish · woocommerce customers managerAug 1, 2024
CVE-2024-1747
26Monitor
WooCommerce Customers Manager < 30.2 - Subscriber+ Stored XSS
MediumCVSS 6.5No exploitEPSS 0%
- XSS
- CSRF
vanquish · woocommerce customers managerAug 1, 2024
CVE-2024-1743
23Monitor
WooCommerce Customers Manager < 29.8 - Reflected XSS
MediumCVSS 5.9No exploitEPSS 0%
- Local privilege escalation
- XSS
vanquish · woocommerce customers managerApr 24, 2024
CVE-2024-13775
21Monitor
WooCommerce Support Ticket System <= 17.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Information Exposure
MediumCVSS 5.4No exploitEPSS 0%
- Broken access control (IDOR)
vanquish · woocommerce support ticket systemFeb 1, 2025