{"error":0,"message":null,"data":{"name":"EU VAT Assistant for WooCommerce","plugin":"woocommerce-eu-vat-assistant","link":"https:\/\/wordpress.org\/plugins\/woocommerce-eu-vat-assistant\/","latest":"1777485060","closed":0,"closed_reason":null,"closed_date":null,"vulnerability":[{"uuid":"9137f71c4f8582bc4d715fccb80054dc06d798b1e5796a0d65df57a499ff4699","name":"EU VAT Assistant for WooCommerce [woocommerce-eu-vat-assistant] < 2.0.28.220224","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.0.28.220224","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"475f43e9a6ee218cecfee6a069c1140c8d92b679","name":"WordPress WooCommerce EU VAT Assistant plugin < 2.0.28.220224 - Sensitive Information Disclosure vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/woocommerce-eu-vat-assistant\/vulnerability\/wordpress-woocommerce-eu-vat-assistant-plugin-2028220224-sensitive-information-disclosure-vulnerability","description":"Sensitive Information Disclosure vulnerability discovered in WordPress WooCommerce EU VAT Assistant plugin (versions < 2.0.28.220224).","date":"2022-02-28"}],"impact":[]},{"uuid":"f856fd73d45c7bb9c35bfa856b0c778e36e027edafc1501115e91e104da9d292","name":"EU VAT Assistant for WooCommerce [woocommerce-eu-vat-assistant] < 2.0.28.220224","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.0.28.220224","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"d63ed3d8eeb94d1cbf1cf08e6467eb311be0d8f2","name":"WordPress WooCommerce EU VAT Assistant plugin < 2.0.28.220224 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/woocommerce-eu-vat-assistant\/vulnerability\/wordpress-woocommerce-eu-vat-assistant-plugin-2028220224-toggle-the-debug-mode-via-cross-site-request-forgery-csrf-vulnerability","description":"Sensitive Information Disclosure vulnerability discovered in WordPress WooCommerce EU VAT Assistant plugin (versions < 2.0.28.220224).","date":"2022-02-28"}],"impact":[]},{"uuid":"d7f13315d794d19c14fc58ad00017b24120fc19a7117fc400997ee925ab7fe35","name":"EU VAT Assistant for WooCommerce [woocommerce-eu-vat-assistant] < 2.0.28.220224","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.0.28.220224","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"6d8910c719b2a132ec93828cd37e418b19cac960","name":"Freemius SDK <= 2.4.2 - Missing Authorization Checks","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/detail\/freemius-sdk-242-missing-authorization-checks","description":"The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.","date":"2022-03-04"},{"id":"CVE-2022-4974","name":"Freemius SDK <= 2.4.2 - Missing Authorization Checks","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2022-4974","description":"The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.","date":"2024-10-16"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:L\/I:L\/A:L","av":"n","ac":"l","pr":"l","ui":"n","s":"u","c":"l","i":"l","a":"l","score":"6.3","severity":"m","exploitable":"2.8","impact":"3.4"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:L\/I:L\/A:L","score":"6.3","severity":"medium","av":"network","ac":"low","pr":"low","ui":"none","s":"unchanged","c":"low","i":"low","a":"low","exploitable":"2.8","impact":"3.4"},"cwe":[{"cwe":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"e187d1ff60fd8f890259656ad236ae2115ea5d209256babc86241daaad10147e","name":"EU VAT Assistant for WooCommerce [woocommerce-eu-vat-assistant] < 2.1.2.230718","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.1.2.230718","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2023-33999","name":"CVE-2023-33999","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2023-33999","description":"[en] Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in WPVibes WP Mail Log allows DOM-Based XSS.\n\nThis issue affects WP Mail Log: from n\/a through 1.0.2.","date":"2026-06-11"},{"id":"e5d001bd62eb0de3d99ca2b6a0e01b7a1976ac55","name":"WordPress  WooCommerce EU VAT Assistant Plugin  <= 2.0.43.230518 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/woocommerce-eu-vat-assistant\/vulnerability\/wordpress-woocommerce-eu-vat-assistant-plugin-2-0-43-230518-reflected-cross-site-scripting-xss-vulnerability","description":"Update the WordPress WooCommerce EU VAT Assistant plugin to the latest available version (at least 2.1.2.230718).\nRafie Muhammad (Patchstack) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress WooCommerce EU VAT Assistant Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site.  This vulnerability has been fixed in version 2.1.2.230718.","date":"2023-07-18"},{"id":"35d2f1e7-a4f8-49fd-a8dd-bb2c26710f93","name":"Freemius SDK &lt; 2.5.10 - Reflected Cross-Site Scripting","link":"https:\/\/wpscan.com\/vulnerability\/35d2f1e7-a4f8-49fd-a8dd-bb2c26710f93","description":"The Freemius SDK for WordPress does not adequately sanitize inputs or escape outputs, leading to Reflected Cross-Site Scripting. This directly affects over 1000 plugins and themes that use this SDK.","date":"2023-07-18"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:L","av":"n","ac":"l","pr":"n","ui":"r","s":"c","c":"l","i":"l","a":"l","score":"7.1","severity":"h","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:L","score":"7.1","severity":"high","av":"network","ac":"low","pr":"none","ui":"required","s":"changed","c":"low","i":"low","a":"low","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}}]},"updated":"1776153795"}