WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product fields✕
Overview 4 matches · 0 in Waratek scope · 0 protected · 0 CISA KEV · 3 public PoC · 0 EPSS ≥ 0.5
4matches 0in Waratek scope0.0% 0protected0.0% 0CISA KEV0.0% 3public PoC75.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 4 100.0% Withdrawn CVE 0 0.0%
Critical 1 25.0% High 2 50.0% Medium 1 25.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 4 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 4 100.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 2 / quarter
Not applicable: 4 Medium: 1High: 2Critical: 1 not blocked: 4 Exploited: 4
Q4 221 Not applicable1 Critical1 not blocked1 Exploited1 Q1 230 Q2 232 Not applicable2 High2 not blocked2 Exploited2 Q3 230 Q4 230 Q1 240 Q2 240 Q3 240 Q4 241 Not applicable1 Medium1 not blocked1 Exploited1
Q4 22Q1 23Q2 23Q3 23Q4 23Q1 24Q2 24Q3 24Q4 24
4 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2024-10857 Medium 2024-11-26 Not applicable Exploited The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.9 via the handle_downloads() function due to insufficient file path validation/sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
CVE-2020-36731 High 2023-06-07 Not applicable Exploited The Flexible Checkout Fields for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Arbitrary Plugin Settings update, in addition to Stored Cross-Site Scripting in versions up to, and including, 2.3.1. This is due to missing authorization checks on the updateSettingsAction() function which is called via an admin_init hook, along with missing sanitization and escaping on the settings that are stored.
CVE-2023-30777 High 2023-05-10 Not applicable Exploited Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WP Engine Advanced Custom Fields Pro, WP Engine Advanced Custom Fields plugins <= 6.1.5 versions.
CVE-2022-4117 Critical 2022-12-26 Not applicable Exploited The IWS WordPress plugin through 1.0 does not properly escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection.