CVE Vulnerability Advisory Database

[Affected Scope] Germanized for WooCommerce WordPress plugin up to, and including, 4.1.4

[Impact] Authenticated attackers with Subscriber-level access can change their account email to a victim's billing email and reuse their original activation token to hijack past guest orders, exposing sensitive billing details.

[Mitigation] Update the plugin to the latest secure version (4.1.5 or higher), or explicitly set 'Disable login for unactivated customers' to Yes.

[Affected Scope] WooCommerce Extra Product Options Pro plugin up to and including version 3.3.2

[Impact] Unauthenticated attackers can execute arbitrary web scripts in the victim's browser session via crafted links, potentially leading to session hijacking

[Mitigation] Immediately update the plugin to the latest secure version (3.3.3 or higher) and apply WAF rules

[Affected Scope] PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin versions up to, and including, 7.1.1

[Impact] Unauthenticated remote attackers can execute arbitrary PHP code on the server and fully compromise the system via malicious payload injection

[Mitigation] Immediately upgrade the plugin to the patched version (7.2.0 or higher) and apply input validation filters on checkout API requests

[Affected Scope] WooCommerce PDF Invoices & Packing Slips WordPress plugin up to and including version 5.16.5

[Impact] Unauthenticated attackers can extract complete PDF invoices of other customers, including billing/shipping addresses, order notes, and pricing, delivered directly to the attacker's email

[Mitigation] Immediately upgrade the plugin to version 5.16.6 or higher, and disable the yearly invoice number reset option as a temporary workaround

[Affected Scope] WordPress WooCommerce PDF Invoices & Packing Slips plugin versions up to, and including, 5.16.4

[Impact] Unauthenticated attackers can inject arbitrary web scripts via billing and note parameters, leading to administrative session hijacking

[Mitigation] Immediately upgrade the plugin to the patched version (5.16.5 or higher) and apply WAF filtering rules

[Affected Scope] YITH WooCommerce Product Add-Ons plugin versions 4.34.0 and below.

[Impact] Unauthenticated attackers can bypass authorization checks by manipulating user-controlled keys to modify data.

[Mitigation] Immediately update the plugin to version 4.35.0 or later.