Cost Of Goods
Approved changes feed: RSS · Atom
cpe:2.3:a:wpcodefactory:cost_of_goods:_product_cost_&_profit_calculator_for_woocommerce:*:*:*:*:*:*:*:*
part: a version: _product_cost_&_profit_calculator_for_woocommerce update: *
| Vendor | Wpcodefactory (ccb47e73-0c04-5c13-bcb7-ae56b2bca3a9) |
|---|---|
| Product | Cost Of Goods (e4c9e639-32cf-5006-96a3-3baea6026769) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-6962 |
vulnerable | 2026-06-03 15:27:55.931379 |
Cost of Goods: Product Cost & Profit Calculator for WooCommerce <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
MEDIUM (6.4)
The Cost of Goods: Product Cost & Profit Calculator for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'alg_wc_cog_product_cost' and 'alg_wc_cog_product_profit' shortcodes in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2026-05-13T04:26:40.282Z
Updated: 2026-05-13T10:22:24.831Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-0821 |
vulnerable | 2026-06-03 14:54:04.253799 |
Cost of Goods Sold (COGS): Cost & Profit Calculator for WooCommerce <= 3.2.8 - Reflected Cross-Site Scripting
MEDIUM (6.1)
The Cost of Goods Sold (COGS): Cost & Profit Calculator for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'section' parameter in all versions up to, and including, 3.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Published: 2024-02-20T18:56:46.928Z
Updated: 2026-04-08T17:25:07.387Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.