Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2024-44004

WordPress WPCargo Track & Trace plugin <= 8.0.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows SQL Injection. This issue affects WPCargo Track & Trace: before 8.0.4.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Wptaskforce
Products
Track \& Trace Wpcargo Track \& Trace
CVE-2022-1436

WPCargo Track & Trace < 6.9.5 - Reflected Cross Site Scripting

The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitise and escape the wpcargo_tracking_number parameter before outputting it back in the page, which could allow attackers to perform reflected Cross-Site Scripting attacks.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Wptaskforce
Products
Track \& Trace
CVE-2022-1435

WPCargo Track & Trace < 6.9.5 - Admin+ Stored Cross Site Scripting

The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitize and escapes some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wptaskforce
Products
Track \& Trace
CVE-2021-25003

WPCargo < 6.9.0 - Unauthenticated RCE

The WPCargo Track & Trace WordPress plugin before 6.9.0 contains a file which could allow unauthenticated attackers to write a PHP file anywhere on the web server, leading to RCE

CVSS 3.1 · 9.8 Critical EPSS 56.1% KEV · Not listed
Vendors
Wptaskforce
Products
Wpcargo Track \& Trace