The Orders Tracking for WooCommerce WordPress plugin before 1.1.10 does not sanitise and escape the fileurl before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting

The Orders Tracking for WooCommerce WordPress plugin before 1.2.6 doesn't validate the fileurl parameter when importing a CSV file, allowing high privilege users with the managewoocommerce capability to access any file on the web server via a Traversal attack. The content retrieved is however limited to the first line of the file.