CVE-2023-28665

🗓️ 22 Mar 2023 00:00:00Reported by tenableType

cve🔗 web.nvd.nist.gov👁 69 Views🌐 WEB

The Woo Bulk Price Update WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripting vulnerability

Reporter	Title	Published	Views	Family All 16
BDU FSTEC	The vulnerability of the Bulk Price Update plugin for Woocommerce in the WordPress content management system allows attackers to perform cross-site scripting attacks.	22 Nov 202300:00	–	bdu_fstec
Circl	CVE-2023-28665	22 Mar 202323:36	–	circl
CNNVD	WordPress plugin Woo Bulk Price Update 跨站脚本漏洞	22 Mar 202300:00	–	cnnvd
Cvelist	CVE-2023-28665	22 Mar 202300:00	–	cvelist
Nuclei	Woo Bulk Price Update <2.2.2 - Cross-Site Scripting	20 Jul 202605:01	–	nuclei
NVD	CVE-2023-28665	22 Mar 202321:15	–	nvd
OpenVAS	WordPress Woo Bulk Price Update Plugin < 2.2.2 XSS Vulnerability	29 Aug 202300:00	–	openvas
OSV	CVE-2023-28665	22 Mar 202321:15	–	osv
Patchstack	WordPress Bulk Price Update for Woocommerce Plugin < 2.2.2 is vulnerable to Cross Site Scripting (XSS)	12 Apr 202300:00	–	patchstack
Prion	Cross site scripting	22 Mar 202321:15	–	prion

NVD

Node

technocrackers bulk_price_update_for_woocommerceRange<2.2.2wordpress

[
  {
    "vendor": "n/a",
    "product": "Woo Bulk Price Update WordPress Plugin",
    "versions": [
      {
        "version": "< 2.2.2",
        "status": "affected"
      }
    ]
  }
]

Source	Link
tenable	www.tenable.com/security/research/tra-2023-3

Parameter	Position	Path	Description	CWE
page	query param	/wp-admin/admin-ajax.php?action=techno_get_products&page=<svg%20onload=alert(1)>	Reflected Cross-Site Scripting via the page parameter in techno_get_products action (authenticated context).	CWE-79

17 Jun 2026 05:48Current

5Medium risk

Vulners AI Score5

CVSS 3.15.4

EPSS0.00887

SSVC

CWE-79