8.8
High
CVE-2023-2843 The MultiParcels Shipping For WooCommerce WordPress plugin before 1.14.15 does not properly sanitize and escape a…
Description
The MultiParcels Shipping For WooCommerce WordPress plugin before 1.14.15 does not properly sanitize and escape a parameter before using it in an SQL statement, which could allow any authenticated users, such as subscribers, to perform SQL Injection attacks.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| MultiParcels Shipping For WooCommerce 1.14 | earliest → < 1.14.15 | 1.14.15 |
Other CVEs of MultiParcels Shipping For WooCommerce
The 5 CVEs of MultiParcels Shipping For WooCommerce →
CVE-2023-3366
The MultiParcels Shipping For WooCommerce WordPress plugin before 1.15.2 does not have CRSF check when deleting a…
4.3
Medium
CVE-2023-3954
The MultiParcels Shipping For WooCommerce WordPress plugin before 1.15.4 does not sanitise and escape a parameter before…
6.1
Medium
CVE-2023-3671
The MultiParcels Shipping For WooCommerce WordPress plugin before 1.15.4 does not sanitise and escape various parameters…
6.1
Medium
CVE-2023-3365
The MultiParcels Shipping For WooCommerce WordPress plugin before 1.14.14 does not have authorisation when deleting…
8.1
High