Oliver Pos
Approved changes feed: RSS · Atom
cpe:2.3:a:oliverpos:oliver_pos:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Oliverpos (2dcbc8d8-2774-5dbc-aec9-b0a63b337bd0) |
|---|---|
| Product | Oliver Pos (41b41a19-f459-5513-b222-73c6b7af1dc9) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-13513 |
vulnerable | 2026-06-08 06:25:37.848295 |
Oliver POS – A WooCommerce Point of Sale (POS) <= 2.4.2.3 - Sensitive Information Exposure to Privilege Escalation
CRITICAL (9.8)
The Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.2.3 via the logging functionality. This makes it possible for unauthenticated attackers to extract sensitive data including the plugin's clientToken, which in turn can be used to change user account information including emails and account type. This allows attackers to then change account passwords resulting in a complete site takeover. Version 2.4.2.3 disabled logging but left sites with existing log files vulnerable.
Published: 2025-02-15T07:33:40.895Z
Updated: 2026-04-08T17:19:27.440Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-0702 |
vulnerable | 2026-06-08 06:22:01.809574 |
Oliver POS – A WooCommerce Point of Sale (POS) <= 2.4.2.1 - Missing Authorization
HIGH (7.3)
The Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several functions hooked via AJAX in the includes/class-pos-bridge-install.php file in all versions up to, and including, 2.4.2.1 This makes it possible for authenticated attackers, with subscriber-level access and above, to perform several unauthorized actions like deactivating the plugin, disconnecting the subscription, syncing the status and more.
Published: 2024-02-20T18:56:42.821Z
Updated: 2026-04-08T17:17:16.673Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.