{"error":0,"message":null,"data":{"name":"WooCommerce Dynamic Pricing & Discounts","plugin":"wc-dynamic-pricing-and-discounts","link":null,"latest":null,"closed":null,"closed_reason":null,"closed_date":null,"vulnerability":[{"uuid":"a303621cd810f82ef8cd42e97e5c023513ab5aaf728a164af7431b5755320bc0","name":"WooCommerce Dynamic Pricing & Discounts [wc-dynamic-pricing-and-discounts] < 2.4.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.4.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"7adbc9cbf31e4a0a640434acd0e1594ea1d5e7db","name":"WordPress WooCommerce Dynamic Pricing & Discounts premium plugin <= 2.4.1 - Unauthenticated Settings Import and Stored XSS vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/wc-dynamic-pricing-and-discounts\/vulnerability\/wordpress-woocommerce-dynamic-pricing-discounts-premium-plugin-2-4-1-unauthenticated-settings-import-and-stored-xss-vulnerability","description":"Unauthenticated Settings Import and Stored XSS vulnerability discovered by Jerome Bruandet (NinTechNet) in WordPress WooCommerce Dynamic Pricing & Discounts premium plugin (versions <= 2.4.1).","date":"2021-08-31"}],"impact":[]},{"uuid":"722aa33502fb55d83492d33c91cd644a3aacac581deebcfa87920939fc133df6","name":"WooCommerce Dynamic Pricing & Discounts [wc-dynamic-pricing-and-discounts] < 2.4.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.4.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"73d0d67948fae20ebc274faac5959e67a371501d","name":"WordPress WooCommerce Dynamic Pricing & Discounts premium plugin <= 2.4.1 - Unauthenticated Settings Export vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/wc-dynamic-pricing-and-discounts\/vulnerability\/wordpress-woocommerce-dynamic-pricing-discounts-premium-plugin-2-4-1-unauthenticated-settings-export-vulnerability","description":"Unauthenticated Settings Export vulnerability discovered by Jerome Bruandet (NinTechNet) in WordPress WooCommerce Dynamic Pricing & Discounts premium plugin (versions <= 2.4.1).","date":"2021-08-31"}],"impact":[]},{"uuid":"77b18d93b6db5f516d3975dab90bcd9abe4cb640e7fde09c8d17c4ba9c3a4dff","name":"WooCommerce Dynamic Pricing & Discounts [wc-dynamic-pricing-and-discounts] < 2.4.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.4.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"b3d88600-4925-4217-9f4d-90b699b3710c","name":"WooCommerce Dynamic Pricing &amp; Discounts &lt; 2.4.2 - Unauthenticated Settings Export","link":"https:\/\/wpscan.com\/vulnerability\/b3d88600-4925-4217-9f4d-90b699b3710c","description":"The plugin does not have authorisation check on its export feature, allowing unauthenticated users to export them.","date":null}],"impact":[]},{"uuid":"05aa5b197951a937c8ba24ce976873c9985f579887a5e5af9ef4cf803d567fc4","name":"WooCommerce Dynamic Pricing & Discounts [wc-dynamic-pricing-and-discounts] < 2.4.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.4.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"aeae6454-6cda-4b43-9d96-e0d4d67b4028","name":"WooCommerce Dynamic Pricing &amp; Discounts &lt; 2.4.2 - Unauthenticated Settings Import to Stored XSS","link":"https:\/\/wpscan.com\/vulnerability\/aeae6454-6cda-4b43-9d96-e0d4d67b4028","description":"The plugin does not have authorisation and CSRF checks on its import feature, nor sanitise or escape the imported settings. This could allow unauthenticated users to import arbitrary settings, and perform Stored Cross-Site Scripting attacks as well.\r\n\r\nPlease note that v2.4.2 is still missing a CSRF check.","date":null}],"impact":[]},{"uuid":"68da9b535c63baad819ca4ed3e36b7594657a4f2d308ab60f3879132ec72da98","name":"WooCommerce Dynamic Pricing & Discounts [wc-dynamic-pricing-and-discounts] < 2.4.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.4.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"037a09cc9e80e7f1f1f46cda6889219be5de8c3e","name":"WooCommerce Dynamic Pricing and Discounts <= 2.4.1 - Unauthenticated Settings Import\/Export","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/wc-dynamic-pricing-and-discounts\/woocommerce-dynamic-pricing-and-discounts-241-unauthenticated-settings-importexport","description":"The WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to unauthenticated settings export in versions up to, and including, 2.4.1. This is due to missing authorization on the export() function which makes makes it possible for unauthenticated attackers to export the plugin's settings.","date":"2021-08-31"},{"id":"CVE-2021-4353","name":"CVE-2021-4353","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2021-4353","description":"[en] The WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to unauthenticated settings export in versions up to, and including, 2.4.1. This is due to missing authorization on the export() function which makes makes it possible for unauthenticated attackers to export the plugin's settings.","date":"2023-10-20"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:L\/I:N\/A:N","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"l","i":"n","a":"n","score":"5.3","severity":"m","exploitable":"3.9","impact":"1.4"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:L\/I:N\/A:N","score":"5.3","severity":"medium","av":"network","ac":"low","pr":"none","ui":"none","s":"unchanged","c":"low","i":"none","a":"none","exploitable":"3.9","impact":"1.4"},"cwe":[{"cwe":"CWE-288","name":"Authentication Bypass Using an Alternate Path or Channel","description":"The product requires authentication, but the product has an alternate path or channel that does not require authentication."},{"cwe":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action."}],"ssvc":{"exploitation":"poc","automatable":"yes","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"2f03aea36c4f15e5c91e6ebfa9713f80dbb31cae3e02aa22858ca4de5b12c9a3","name":"WooCommerce Dynamic Pricing & Discounts [wc-dynamic-pricing-and-discounts] < 2.4.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.4.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"0c6e242cc59a2987e5bd7317afebafb79603ae6d","name":"WooCommerce Dynamic Pricing and Discounts <= 2.4.1 - Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/wc-dynamic-pricing-and-discounts\/woocommerce-dynamic-pricing-and-discounts-241-stored-cross-site-scripting","description":"The WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.1. This is due to missing sanitization on the settings imported via the import() function. This makes it possible for unauthenticated attackers to import a settings file containing malicious JavaScript that would execute when an administrator accesses the settings area of the site.","date":"2021-08-31"},{"id":"CVE-2021-4372","name":"CVE-2021-4372","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2021-4372","description":"[en] The WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.1. This is due to missing sanitization on the settings imported via the import() function. This makes it possible for unauthenticated attackers to import a settings file containing malicious JavaScript that would execute when an administrator accesses the settings area of the site.","date":"2023-06-07"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"n","ui":"r","s":"c","c":"l","i":"l","a":"n","score":"6.1","severity":"m","exploitable":"2.8","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N","score":"6.1","severity":"medium","av":"network","ac":"low","pr":"none","ui":"required","s":"changed","c":"low","i":"low","a":"none","exploitable":"2.8","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","kev":false,"kev_date":null}}}]},"updated":"1671607962"}