Vitepos – Point Of Sale (Pos) For Woocommerce
Approved changes feed: RSS · Atom
cpe:2.3:a:appsbd:vitepos_–_point_of_sale_(pos)_for_woocommerce:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Appsbd (12e76fbc-009b-5ef4-80e1-4b436e4542de) |
|---|---|
| Product | Vitepos – Point Of Sale (Pos) For Woocommerce (512ba6d1-a429-50a0-bf90-5607ba8e69de) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-13156 |
vulnerable | 2026-06-08 07:04:31.710070 |
Vitepos – Point of Sale (POS) for WooCommerce <= 3.3.0 - Authenticated (Subscriber+) Arbitrary File Upload to Remote Code Execution
HIGH (8.8)
The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the insert_media_attachment() function in all versions up to, and including, 3.3.0. This is due to the save_update_category_img() function accepting user-supplied file types without validation when processing category images. This makes it possible for authenticated attackers, with subscriber level access and above, to upload arbitrary files on the affected site's server which makes remote code execution possible.
Published: 2025-11-21T08:28:15.190Z
Updated: 2026-04-08T17:18:56.867Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.