wp-ecommerce records
10 published records for vendor wp-ecommerce.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 1 · 10%
- Pre-auth RCE
- 0
- With a fix record
- 50%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')2
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')2
- CWE-502 Deserialization of Untrusted Data1
- CWE-532 Insertion of Sensitive Information into Log File1
- CWE-94 Improper Control of Generation of Code ('Code Injection')1
- CWE-862 Missing Authorization1
The weakness classes this vendor ships most often: where to look.
CWEAll records
10 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
49Plan | CVE-2020-35234Weaponized | The easy-wp-smtp plugin before 1.4.4 for WordPress allows Administrator account takeover, as exploited in the wild in December 2020.wp-ecommerce · easy wp smtp · CWE-532 | High7.5 | — | 63.4% | Dec 13, 2020 |
40Plan | CVE-2019-25141Proof of concept | Easy WP SMTP <= 1.3.9 - Missing Authorization to Arbitrary Options Updatewp-ecommerce · easy wp smtp · CWE-862 | Critical9.8 | — | 4.4% | Jun 6, 2023 |
35Monitor | CVE-2022-42699No exploit | WordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Remote Code Execution (RCE)wp-ecommerce · easy wp smtp · CWE-94 | High8.8 | — | 1.4% | Dec 6, 2022 |
32Monitor | CVE-2022-45829No exploit | WordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Arbitrary File Deletionwp-ecommerce · easy wp smtp · CWE-22 | High8.1 | — | 0.8% | Dec 6, 2022 |
30Monitor | CVE-2024-1514No exploit | WP eCommerce <= 3.15.1 - Unauthenticated SQL Injectionwp-ecommerce · wp ecommerce · CWE-89 | High7.5 | — | 0.7% | Feb 28, 2024 |
28Monitor | CVE-2022-3334No exploit | Easy WP SMTP < 1.5.0 - Admin+ PHP Objection Injectionwp-ecommerce · easy wp smtp · CWE-502 | High7.2 | — | 1.2% | Oct 31, 2022 |
26Monitor | CVE-2022-45833No exploit | WordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Directory Traversalwp-ecommerce · easy wp smtp · CWE-22 | Medium6.5 | — | 0.8% | Dec 6, 2022 |
24Monitor | CVE-2017-7723No exploit | XSS exists in Easy WP SMTP (before 1.2.5), a WordPress Plugin, via the e-mail subject or body.wp-ecommerce · easy wp smtp · CWE-79 | Medium6.1 | — | 0.7% | Apr 24, 2017 |
21Monitor | CVE-2024-35676No exploit | WordPress Recurring PayPal Donations plugin <= 1.7 - Cross Site Scripting (XSS) vulnerabilitywp-ecommerce · recurring paypal donations · CWE-79 | Medium5.4 | — | 0.2% | Jun 8, 2024 |
10Monitor | CVE-2024-3073No exploit | Easy WP SMTP by SendLayer <= 2.3.0 - Exposure of Sensitive Information via the UIwp-ecommerce · easy wp smtp · CWE-257 | Low2.7 | — | 0.3% | Jun 13, 2024 |
- CVE-2020-3523449Plan
The easy-wp-smtp plugin before 1.4.4 for WordPress allows Administrator account takeover, as exploited in the wild in December 2020.
HighCVSS 7.5WeaponizedEPSS 63%wp-ecommerce · easy wp smtpDec 13, 2020
- CVE-2019-2514140Plan
Easy WP SMTP <= 1.3.9 - Missing Authorization to Arbitrary Options Update
CriticalCVSS 9.8Proof of conceptEPSS 4%wp-ecommerce · easy wp smtpJun 6, 2023
- CVE-2022-4269935Monitor
WordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Remote Code Execution (RCE)
HighCVSS 8.8No exploitEPSS 1%wp-ecommerce · easy wp smtpDec 6, 2022
- CVE-2022-4582932Monitor
WordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Arbitrary File Deletion
HighCVSS 8.1No exploitEPSS 0%wp-ecommerce · easy wp smtpDec 6, 2022
- CVE-2024-151430Monitor
WP eCommerce <= 3.15.1 - Unauthenticated SQL Injection
HighCVSS 7.5No exploitEPSS 0%wp-ecommerce · wp ecommerceFeb 28, 2024
- CVE-2022-333428Monitor
Easy WP SMTP < 1.5.0 - Admin+ PHP Objection Injection
HighCVSS 7.2No exploitEPSS 1%wp-ecommerce · easy wp smtpOct 31, 2022
- CVE-2022-4583326Monitor
WordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Directory Traversal
MediumCVSS 6.5No exploitEPSS 0%wp-ecommerce · easy wp smtpDec 6, 2022
- CVE-2017-772324Monitor
XSS exists in Easy WP SMTP (before 1.2.5), a WordPress Plugin, via the e-mail subject or body.
MediumCVSS 6.1No exploitEPSS 0%wp-ecommerce · easy wp smtpApr 24, 2017
- CVE-2024-3567621Monitor
WordPress Recurring PayPal Donations plugin <= 1.7 - Cross Site Scripting (XSS) vulnerability
MediumCVSS 5.4No exploitEPSS 0%wp-ecommerce · recurring paypal donationsJun 8, 2024
- CVE-2024-307310Monitor
Easy WP SMTP by SendLayer <= 2.3.0 - Exposure of Sensitive Information via the UI
LowCVSS 2.7No exploitEPSS 0%wp-ecommerce · easy wp smtpJun 13, 2024