Sploitus

10 exploited vulnerabilities in Booster For Woocommerce

Vulnerabilities with publicly known exploits

Vendors
WordPress
With known exploits
10
Affected Booster Booster For Woocommerce versions
≤ 5.4.3, 6.0.1, 1.1.7, 5.6.5, 5.6.7, 1.1.8, 5.6.6, 5.6.3, 5.4.9, 7.1.1
Affected Booster Booster Elite Woocommerce versions
< 6.0.1
Affected Booster Booster Plus Woocommerce versions
< 6.0.1
Affected Booster Booster Elite For Woocommerce versions
< 6.0.0
Affected Booster Booster Plus For Woocommerce versions
< 6.0.0

Vulnerabilities with exploits

Highest CVSS first — 7 of these already have exploit code on Sploitus

CVE-2021-34646 7 exploits
CVSS 9.8 CRITICAL 2021-08-30FIX AVAILABLE
Exploit for Authentication Bypass by Spoofing in Booster Booster_For_WoocommerceExploit for Authentication Bypass by Spoofing in Booster Booster_For_Woocommerce
CVE-2022-4017
CVSS 8.8 HIGH 2023-01-23FIX AVAILABLE
CVE-2022-3763 1 exploit
CVSS 8.1 HIGH 2022-11-21FIX AVAILABLE
Booster for WooCommerce - Checkout Files Deletion via CSRF
CVE-2022-4016 1 exploit
CVSS 6.5 MEDIUM 2022-12-12FIX AVAILABLE
Booster for WooCommerce - Custom Role Creation/Deletion via CSRF
CVE-2022-3762 1 exploit
CVSS 6.5 MEDIUM 2022-11-21FIX AVAILABLE
Booster for WooCommerce - ShopManager+ Arbitrary File Download
CVE-2022-4227
CVSS 6.1 MEDIUM 2022-12-26FIX AVAILABLE
CVE-2021-25001 1 exploit
CVSS 6.1 MEDIUM 2022-01-03FIX AVAILABLE
Booster for WooCommerce < 5.4.9 - Reflected Cross-Site Scripting in Product XML Feeds Module
CVE-2021-25000 1 exploit
CVSS 6.1 MEDIUM 2022-01-03FIX AVAILABLE
Booster for WooCommerce < 5.4.9 - Reflected Cross-Site Scripting in General Module
CVE-2021-24999 1 exploit
CVSS 6.1 MEDIUM 2022-01-03FIX AVAILABLE
Booster for Woocommerce < 5.4.9 - Reflected Cross-Site Scripting in PDF Invoicing Module
CVE-2023-4796
CVSS 4.3 MEDIUM 2023-10-20FIX AVAILABLE