{"error":0,"message":null,"data":{"name":"EU VAT Assistant for WooCommerce","plugin":"woocommerce-eu-vat-assistant","link":"https:\/\/wordpress.org\/plugins\/woocommerce-eu-vat-assistant\/","latest":"1791196560","closed":0,"closed_reason":null,"closed_date":null,"vulnerability":[{"uuid":"9137f71c4f8582bc4d715fccb80054dc06d798b1e5796a0d65df57a499ff4699","name":"EU VAT Assistant for WooCommerce [woocommerce-eu-vat-assistant] < 2.0.28.220224","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.0.28.220224","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"475f43e9a6ee218cecfee6a069c1140c8d92b679","name":"WordPress WooCommerce EU VAT Assistant plugin < 2.0.28.220224 - Sensitive Information Disclosure vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/woocommerce-eu-vat-assistant\/vulnerability\/wordpress-woocommerce-eu-vat-assistant-plugin-2028220224-sensitive-information-disclosure-vulnerability","description":"Sensitive Information Disclosure vulnerability discovered in WordPress WooCommerce EU VAT Assistant plugin (versions < 2.0.28.220224).","date":"2022-02-28"}],"impact":[]},{"uuid":"f856fd73d45c7bb9c35bfa856b0c778e36e027edafc1501115e91e104da9d292","name":"EU VAT Assistant for WooCommerce [woocommerce-eu-vat-assistant] < 2.0.28.220224","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.0.28.220224","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"d63ed3d8eeb94d1cbf1cf08e6467eb311be0d8f2","name":"WordPress WooCommerce EU VAT Assistant plugin < 2.0.28.220224 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/woocommerce-eu-vat-assistant\/vulnerability\/wordpress-woocommerce-eu-vat-assistant-plugin-2028220224-toggle-the-debug-mode-via-cross-site-request-forgery-csrf-vulnerability","description":"Sensitive Information Disclosure vulnerability discovered in WordPress WooCommerce EU VAT Assistant plugin (versions < 2.0.28.220224).","date":"2022-02-28"}],"impact":[]},{"uuid":"d7f13315d794d19c14fc58ad00017b24120fc19a7117fc400997ee925ab7fe35","name":"EU VAT Assistant for WooCommerce [woocommerce-eu-vat-assistant] < 2.0.28.220224","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.0.28.220224","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"6d8910c719b2a132ec93828cd37e418b19cac960","name":"Freemius SDK <= 2.4.2 - Missing Authorization Checks","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/detail\/freemius-sdk-242-missing-authorization-checks","description":"The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.","date":"2022-03-04"},{"id":"CVE-2022-4974","name":"Freemius SDK <= 2.4.2 - Missing Authorization Checks","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2022-4974","description":"The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.","date":"2024-10-16"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:L\/I:L\/A:L","av":"n","ac":"l","pr":"l","ui":"n","s":"u","c":"l","i":"l","a":"l","score":"6.3","severity":"m","exploitable":"2.8","impact":"3.4"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:L\/I:L\/A:L","score":"6.3","severity":"medium","av":"network","ac":"low","pr":"low","ui":"none","s":"unchanged","c":"low","i":"low","a":"low","exploitable":"2.8","impact":"3.4"},"cwe":[{"cwe":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"e187d1ff60fd8f890259656ad236ae2115ea5d209256babc86241daaad10147e","name":"EU VAT Assistant for WooCommerce [woocommerce-eu-vat-assistant] < 2.1.2.230718","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.1.2.230718","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2023-33999","name":"CVE-2023-33999","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2023-33999","description":"[en] Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in WPVibes WP Mail Log allows DOM-Based XSS.\n\nThis issue affects WP Mail Log: from n\/a through 1.0.2.","date":"2026-06-11"},{"id":"e5d001bd62eb0de3d99ca2b6a0e01b7a1976ac55","name":"WordPress  WooCommerce EU VAT Assistant Plugin  <= 2.0.43.230518 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/woocommerce-eu-vat-assistant\/vulnerability\/wordpress-woocommerce-eu-vat-assistant-plugin-2-0-43-230518-reflected-cross-site-scripting-xss-vulnerability","description":"Update the WordPress WooCommerce EU VAT Assistant plugin to the latest available version (at least 2.1.2.230718).\nRafie Muhammad (Patchstack) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress WooCommerce EU VAT Assistant Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site.  This vulnerability has been fixed in version 2.1.2.230718.","date":"2023-07-18"},{"id":"35d2f1e7-a4f8-49fd-a8dd-bb2c26710f93","name":"Freemius SDK &lt; 2.5.10 - Reflected Cross-Site Scripting","link":"https:\/\/wpscan.com\/vulnerability\/35d2f1e7-a4f8-49fd-a8dd-bb2c26710f93","description":"The Freemius SDK for WordPress does not adequately sanitize inputs or escape outputs, leading to Reflected Cross-Site Scripting. This directly affects over 1000 plugins and themes that use this SDK.","date":"2023-07-18"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:L","av":"n","ac":"l","pr":"n","ui":"r","s":"c","c":"l","i":"l","a":"l","score":"7.1","severity":"h","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:L","score":"7.1","severity":"high","av":"network","ac":"low","pr":"none","ui":"required","s":"changed","c":"low","i":"low","a":"low","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"3cd06b87e4b45eb9cf18d35d4bdc1ae1b5ea62c0257c7daf897b4650fe49d0f1","name":"EU VAT Assistant for WooCommerce [woocommerce-eu-vat-assistant] < 2.2.0","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.2.0","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-103899","name":"CVE-2026-103899","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-103899","description":"[en] The EU VAT Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vat_number' parameter in all versions up to, and including, 2.1.30.260413 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The stored payload executes in the administrator's browser context when reviewing an order via WooCommerce \u2192 Orders \u2192 Edit Order, enabling privilege escalation up to and including full site takeover via rogue administrator account creation.","date":"2026-10-17"},{"id":"34af34e2b0712431509d3a03673ed72067a7597b","name":"WordPress WooCommerce EU VAT Assistant Plugin <= 2.1.30.260413 is vulnerable to a medium priority Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/woocommerce-eu-vat-assistant\/vulnerability\/wordpress-eu-vat-assistant-for-woocommerce-plugin-2-1-30-260413-unauthenticated-stored-cross-site-scripting-vulnerability","description":"<p>WordPress WooCommerce EU VAT Assistant Plugin <= 2.1.30.260413 is vulnerable to a medium priority Cross Site Scripting (XSS)<\/p><p>Software: WooCommerce EU VAT Assistant<\/p><p>Fixed in version 2.2.0 <\/p><p>Affected Version <= 2.1.30.260413<\/p><p>CVE: CVE-2026-103899<\/p>","date":"2026-10-16"},{"id":"c6d58450572c689ff32139ac2723aa40d1505520","name":"EU VAT Assistant for WooCommerce <= 2.1.30.260413 - Unauthenticated Stored Cross-Site Scripting via 'vat_number' Parameter","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/woocommerce-eu-vat-assistant\/eu-vat-assistant-for-woocommerce-2130260413-unauthenticated-stored-cross-site-scripting-via-vat-number-parameter","description":"The EU VAT Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vat_number' parameter in all versions up to, and including, 2.1.30.260413 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The stored payload executes in the administrator's browser context when reviewing an order via WooCommerce \u2192 Orders \u2192 Edit Order, enabling privilege escalation up to and including full site takeover via rogue administrator account creation.","date":"2023-07-18"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"n","ui":"n","s":"c","c":"l","i":"l","a":"n","score":"7.2","severity":"h","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:C\/C:L\/I:L\/A:N","score":"7.2","severity":"high","av":"network","ac":"low","pr":"none","ui":"none","s":"changed","c":"low","i":"low","a":"none","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}}]},"updated":"1792215696"}