Vulnerability history

Subscriber+ Arbitrary Store Data and Ownership Overwrite vulnerability

Store Owner+ Privilege Escalation to Administrator vulnerability

Unauthenticated Vendor PII and Payout Data Disclosure vulnerability

Store Owner+ Cross-Store Commission Data Disclosure via commissions REST Endpoint vulnerability

Broken Access Control vulnerability

Broken Access Control vulnerability

Store Owner+ Cross-Vendor Store Takeover and Deletion vulnerability

Incorrect Authorization to Authenticated (Contributor+) Arbitrary Post Deletion vulnerability

Broken Access Control vulnerability

Sensitive Data Exposure Vulnerability

Cross Site Scripting (XSS) Vulnerability

Missing Authorization to Unauthenticated Table Rates Deletion vulnerability

Unauthenticated Limited Local File Inclusion vulnerability

Cross Site Scripting (XSS) vulnerability

Cross-Site Request Forgery to Vendor Updates vulnerability

Missing Authorization to Forged Vendor Profile Deletion Email Sending vulnerability

Missing Authorization to Limited Vendor Privilege Escalation/Account Takeover vulnerability

Reflected Cross Site Scripting (XSS) vulnerability

Authenticated (Contributor+) Stored Cross-Site Scripting via hover_animation Parameter vulnerability

Broken Access Control vulnerability

Cross Site Scripting (XSS) vulnerability

Broken Access Control vulnerability

Broken Access Control vulnerability

Unauthenticated Local File Inclusion (LFI) vulnerability

Reflected Cross-Site Scripting vulnerability

Unauthorized AJAX Calls Vulnerability

Reflected Cross-Site Scripting (XSS) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability

Unauthenticated Arbitrary Product Comment Posting vulnerability

Cross-Site Request Forgery (CSRF) vulnerability