Advisories · Technology
corvusinfo CorvusPay WooCommerce Payment Gateway.
Every CVE that names corvusinfo CorvusPay WooCommerce Payment Gateway among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.2 High
CorvusPay WooCommerce Payment Gateway <= 2.7.4 - Unauthenticated Stored Cross-Site Scripting via 'approval_code' Parameter
- corvusinfo CorvusPay WooCommerce Payment Gateway
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
CorvusPay WooCommerce Payment Gateway <= 2.7.4 - Missing Authorization to Unauthenticated Arbitrary Order Cancellation via 'order_number' Parameter
- corvusinfo CorvusPay WooCommerce Payment Gateway
- Broken access control
- CVSS 5.3 Medium
CorvusPay WooCommerce Payment Gateway <= 2.7.4 - Unauthenticated Improper Verification of Cryptographic Signature to Payment Bypass via /wp-json/corvuspay/success/ REST Endpoint
- corvusinfo CorvusPay WooCommerce Payment Gateway
- Weak cryptography or TLS