CVE-2021-34664

The Moova for WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the lat parameter in the ~/Checkout/Checkout.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.5.

• CWE-79
• CWE-79

• https://plugins.trac.wordpress.org/browser/moova-for-woocommerce/tags/3.5/Checkout/Checkout.php#L57Exploit, Third Party Advisory
• https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34664Exploit, Third Party Advisory
• https://plugins.trac.wordpress.org/browser/moova-for-woocommerce/tags/3.5/Checkout/Checkout.php#L57Exploit, Third Party Advisory
• https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34664Exploit, Third Party Advisory

Published

Aug 16, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-34658The Simple Popup Newsletter WordPress plugin is vulnerable t…6.1
• CVE-2021-34659The Plugmatter Pricing Table Lite WordPress plugin is vulner…6.1
• CVE-2021-3466A flaw was found in libmicrohttpd. A missing bounds check in…9.8
• CVE-2021-34660The WP Fusion Lite WordPress plugin is vulnerable to Reflect…6.1
• CVE-2021-34661The WP Fusion Lite WordPress plugin is vulnerable to Cross-S…4.7
• CVE-2021-34663The jQuery Tagline Rotator WordPress plugin is vulnerable to…6.1
• CVE-2021-34665The WP SEO Tags WordPress plugin is vulnerable to Reflected …6.1
• CVE-2021-34666The Add Sidebar WordPress plugin is vulnerable to Reflected …6.1
• CVE-2021-34667The Calendar_plugin WordPress plugin is vulnerable to Reflec…6.1
• CVE-2021-34668The WordPress Real Media Library WordPress plugin is vulnera…5.4
• CVE-2021-3467A NULL pointer dereference flaw was found in the way Jasper …5.5
• CVE-2021-34675Basix NEX-Forms through 7.8.7 allows authentication bypass f…7.5