CVE-2022-0215: The Login/Signup Popup, Waitlist Woocommerce ( Back in stock notifier ), and Side Cart Woocommerce (Ajax) WordPress plugins by XootiX are vulnerable to…

PriorityP344high8.8CVSS 3.1

AVNACLPRNUIRSUCHIHAH

EPSS

0.82%

52.6th percentile

The Login/Signup Popup, Waitlist Woocommerce ( Back in stock notifier ), and Side Cart Woocommerce (Ajax) WordPress plugins by XootiX are vulnerable to Cross-Site Request Forgery via the save_settings function found in the ~/includes/xoo-framework/admin/class-xoo-admin-settings.php file which makes it possible for attackers to update arbitrary options on a site that can be used to create an administrative user account and grant full privileged access to a compromised site. This affects versions <= 2.2 in Login/Signup Popup, versions <= 2.5.1 in Waitlist Woocommerce ( Back in stock notifier ), and versions <= 2.0 in Side Cart Woocommerce (Ajax).

Affected

6 ranges

Vendor	Product	Version range	Fixed in
xootix	login_signup_popup	<= 2.2	—
xootix	login_signup_popup	2.2 – 2.2	—
xootix	side_cart_woocommerce	<= 2.0	—
xootix	side_cart_woocommerce	2.0 – 2.0	—
xootix	waitlist_woocommerce	<= 2.5.1	—
xootix	waitlist_woocommerce	2.5.1 – 2.5.1	—

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.