Vulnerability history

Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback vulnerability

Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter vulnerability

Session Fixation via uscesid Parameter vulnerability

Editor+ SQL Injection via CSV Import vulnerability

Unauthenticated Payment Bypass via Forged Settlement Callback vulnerability

Author+ Stored XSS via Product Name vulnerability

Cross Site Scripting (XSS) vulnerability

Broken Access Control vulnerability

Authenticated (Editor+) Stored Cross-Site Scripting vulnerability

Missing Authorization to Unauthenticated Information Exposure vulnerability

Authenticated (Editor+) Stored Cross-Site Scripting via order_mail vulnerability

Broken Access Control vulnerability

Authenticated (Author+) SQL Injection via Cookie vulnerability

Cross Site Scripting (XSS) Vulnerability

PHP Object Injection Vulnerability

Cross Site Scripting (XSS) Vulnerability

Arbitrary File Deletion Vulnerability

Unauthenticated Stored Cross-Site Scripting via name Parameter vulnerability

Broken Access Control + CSRF vulnerability

SQL Injection vulnerability

Authenticated (Administrator+) Directory Traversal vulnerability

Authenticated (Administrator+) PHP Object Injection vulnerability

Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated(level_5+) SQL Injection via get_logs vulnerability

Cross Site Scripting (XSS) vulnerability

Contributor+ Stored XSS via Shortcode vulnerability

Unauth. Arbitrary File Access vulnerability

Auth. PHAR Deserialization vulnerability

Auth. Arbitrary File Access vulnerability

Auth. Arbitrary Shipping Method Creation/Update/Deletion vulnerability

Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilities

Unauth. Directory Traversal vulnerability

Unauthenticated Information Disclosure vulnerability

Authenticated System Information Disclosure vulnerability

Cross-Site Scripting (XSS) vulnerability

SQL injection (SQLi) vulnerability

Authenticated PHP Object Injection vulnerability