Ali2woo

ali2woo

4 CVEs • 2 products

Products (2)

Click to collapse

Toggle

Aliexpress Dropshipping With Alinext

aliexpress_dropshipping_with_alinext

CVEs (4)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2024-37211 1Ali2woo 1Aliexpress Dropshipping With Alinext Nov 21, 2024 Jul 22, 2024 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ali2Woo Team Ali2Woo Lite allows Reflected XSS.This issue affects Ali2Woo Lite: from n/a through 3.3.5.
CVE-2024-37212 1Ali2woo 2Ali2woo Aliexpress Dropshipping With Alinext Feb 27, 2026 Jun 21, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 Cross-Site Request Forgery (CSRF) vulnerability in Ali2Woo Ali2Woo Lite.This issue affects Ali2Woo Lite: from n/a through 3.3.5.
CVE-2024-4450 1Ali2woo 1Aliexpress Dropshipping With Alinext Apr 8, 2026 Jun 19, 2024 N/A· v4 6.3 MEDIUM· v3 N/A· v2 The AliExpress Dropshipping with AliNext Lite plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the ImportAjaxController.php file in all versions up to, a...Show more The AliExpress Dropshipping with AliNext Lite plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the ImportAjaxController.php file in all versions up to, and including, 3.3.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform several actions like importing and modifying products. CVE-2024-37210 is likely a duplicate of this issue.Show less
CVE-2024-2381 1Ali2woo 1Aliexpress Dropshipping With Alinext Apr 8, 2026 Jun 19, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 The AliExpress Dropshipping with AliNext Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_save_image function in all versions up to, and including, 3.3.5....Show more The AliExpress Dropshipping with AliNext Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_save_image function in all versions up to, and including, 3.3.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.Show less