Otp Login Woocommerce & Gravity Forms
Approved changes feed: RSS · Atom
cpe:2.3:a:xootix:otp_login_woocommerce_\&_gravity_forms:*:*:*:*:*:wordpress:*:*
part: a version: * update: *
| Vendor | Xootix (678c2a3b-5064-50d1-81f7-34ae41e26f15) |
|---|---|
| Product | Otp Login Woocommerce & Gravity Forms (dee165d0-0184-5121-b5fc-a49497a3734b) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | wordpress |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-5324 |
vulnerable | 2026-06-08 06:56:15.519627 |
XootiX Framework <= Various Plugin Versions - Missing Authorization to Arbitrary Options Update
HIGH (8.8)
Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the 'import_settings' function in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.
Published: 2024-06-06T02:02:48.411Z
Updated: 2026-04-08T16:32:18.330Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-2706 |
vulnerable | 2026-06-08 06:02:42.865583 |
OTP Login Woocommerce & Gravity Forms <= 2.2 - Authentication Bypass to Privilege Escalation
HIGH (8.1)
The OTP Login Woocommerce & Gravity Forms plugin for WordPress is vulnerable to authentication bypass. This is due to the fact that when generating OTP codes for users to use in order to login via phone number, the plugin returns these codes in an AJAX response. This makes it possible for unauthenticated attackers to obtain login codes for administrators. This does require an attacker have access to the phone number configured for an account, which can be obtained via social engineering or reconnaissance.
Published: 2023-05-17T01:58:49.447Z
Updated: 2026-04-08T17:16:17.788Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.