Search criteria

2 vulnerabilities by codisto

CVE-2025-68041 (GCVE-0-2025-68041)

Vulnerability from cvelistv5 – Published: 2026-01-22 16:52 – Updated: 2026-01-22 16:52
VLAI?
Title
WordPress Omnichannel for WooCommerce plugin <= 1.3.65 - Cross Site Scripting (XSS) vulnerability
Summary
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codisto Omnichannel for WooCommerce codistoconnect allows Stored XSS.This issue affects Omnichannel for WooCommerce: from n/a through <= 1.3.65.
Severity ?
No CVSS data available.
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version
codisto Omnichannel for WooCommerce Affected: n/a , ≤ <= 1.3.65 (custom)
Create a notification for this product.
Credits
guardimo | Patchstack Bug Bounty Program
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "codistoconnect",
          "product": "Omnichannel for WooCommerce",
          "vendor": "codisto",
          "versions": [
            {
              "lessThanOrEqual": "\u003c= 1.3.65",
              "status": "affected",
              "version": "n/a",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "guardimo | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-01-22T17:44:25.094Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in codisto Omnichannel for WooCommerce codistoconnect allows Stored XSS.\u003cp\u003eThis issue affects Omnichannel for WooCommerce: from n/a through \u003c= 1.3.65.\u003c/p\u003e"
            }
          ],
          "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in codisto Omnichannel for WooCommerce codistoconnect allows Stored XSS.This issue affects Omnichannel for WooCommerce: from n/a through \u003c= 1.3.65."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "Stored XSS"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-22T16:52:05.698Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/Wordpress/Plugin/codistoconnect/vulnerability/wordpress-omnichannel-for-woocommerce-plugin-1-3-65-cross-site-scripting-xss-vulnerability?_s_id=cve"
        }
      ],
      "title": "WordPress Omnichannel for WooCommerce plugin \u003c= 1.3.65 - Cross Site Scripting (XSS) vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2025-68041",
    "datePublished": "2026-01-22T16:52:05.698Z",
    "dateReserved": "2025-12-15T10:01:07.754Z",
    "dateUpdated": "2026-01-22T16:52:05.698Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-11727 (GCVE-0-2025-11727)

Vulnerability from cvelistv5 – Published: 2025-12-04 04:29 – Updated: 2025-12-04 14:19
VLAI?
Title
Omnichannel for WooCommerce: Google, Amazon, eBay & Walmart Integration - Powered by Codisto <= 1.3.65 - Unauthenticated Stored Cross-Site Scripting
Summary
The Omnichannel for WooCommerce: Google, Amazon, eBay & Walmart Integration – Powered by Codisto plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the sync() function in all versions up to, and including, 1.3.65 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity ?
7.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version
codisto Omnichannel for WooCommerce: Google, Amazon, eBay & Walmart Integration – Powered by Codisto Affected: * , ≤ 1.3.65 (semver)
Create a notification for this product.
Credits
Angus Girvan
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-11727",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-04T14:19:10.271757Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-04T14:19:17.245Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Omnichannel for WooCommerce: Google, Amazon, eBay \u0026 Walmart Integration \u2013 Powered by Codisto",
          "vendor": "codisto",
          "versions": [
            {
              "lessThanOrEqual": "1.3.65",
              "status": "affected",
              "version": "*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Angus Girvan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Omnichannel for WooCommerce: Google, Amazon, eBay \u0026 Walmart Integration \u2013 Powered by Codisto plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the sync() function in all versions up to, and including, 1.3.65 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-04T04:29:01.167Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f4e3b796-af9a-4403-8d9a-1b56d7253b45?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/codistoconnect/trunk/connect.php#L2101"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/codistoconnect/trunk/connect.php#L3063"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/codistoconnect/trunk/connect.php#L3248"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/codistoconnect/trunk/connect.php#L2117"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/codistoconnect/trunk/connect.php#L3249"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-10-11T00:00:00.000+00:00",
          "value": "Discovered"
        },
        {
          "lang": "en",
          "time": "2025-12-03T15:51:28.000+00:00",
          "value": "Disclosed"
        }
      ],
      "title": "Omnichannel for WooCommerce: Google, Amazon, eBay \u0026 Walmart Integration - Powered by Codisto \u003c= 1.3.65 - Unauthenticated Stored Cross-Site Scripting"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2025-11727",
    "datePublished": "2025-12-04T04:29:01.167Z",
    "dateReserved": "2025-10-13T22:46:45.514Z",
    "dateUpdated": "2025-12-04T14:19:17.245Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}