Return Refund And Exchange For Woocommerce
Approved changes feed: RSS · Atom
cpe:2.3:a:wpswings:return_refund_and_exchange_for_woocommerce:*:*:*:*:*:wordpress:*:*
part: a version: * update: *
| Vendor | Wpswings (325d4910-7fb8-5524-97f5-2fb5d0fe400a) |
|---|---|
| Product | Return Refund And Exchange For Woocommerce (e086817d-bc87-5e43-9973-c58e2d6aab0a) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | wordpress |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/wpswings/woo-refund-and-exchange-lite |
purl2cpe | 2026-06-01 10:16:33.707030 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-13692 |
vulnerable | 2026-06-03 14:54:25.268326 |
Return Refund and Exchange For WooCommerce <= 4.4.5 - Authenticated (Subscriber+) Insecure Direct Object Reference
MEDIUM (5.4)
The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.4.5 via several functions due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to overwrite linked refund image attachments, overwrite refund request message, overwrite order messages, and read order messages of other users.
Published: 2025-02-14T05:22:44.354Z
Updated: 2026-04-08T17:27:26.757Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-13641 |
vulnerable | 2026-06-03 14:54:25.143531 |
Return Refund and Exchange For WooCommerce <= 4.4.5 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
MEDIUM (5.9)
The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.5 via the 'attachment' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/attachment directory which can contain file attachments for order refunds.
Published: 2025-02-14T05:22:43.741Z
Updated: 2026-04-08T16:56:24.154Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4047 |
vulnerable | 2026-06-03 14:48:34.997528 |
Return Refund and Exchange For WooCommerce < 4.0.9 - Unauthenticated Arbitrary File Upload
The Return Refund and Exchange For WooCommerce WordPress plugin before 4.0.9 does not validate attachment files to be uploaded via an AJAX action available to unauthenticated users, which could allow them to upload arbitrary files such as PHP and lead to RCE
Published: 2022-12-26T12:28:13.684Z
Updated: 2025-04-14T13:47:55.922Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.