Lucene search

K
cvelistPatchstackCVELIST:CVE-2023-34170
HistoryJun 22, 2023 - 2:26 p.m.

CVE-2023-34170 WordPress Quick/Bulk Order Form for WooCommerce Plugin <= 3.5.7 is vulnerable to Cross Site Scripting (XSS)

2023-06-2214:26:25
CWE-79
Patchstack
www.cve.org
3
cve-2023-34170
cross site scripting
wordpress
woocommerce
admin
vulnerability

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

EPSS

0.001

Percentile

18.0%

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP Overnight Quick/Bulk Order Form for WooCommerce plugin <=Β 3.5.7 versions.

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "woocommerce-bulk-order-form",
    "product": "Quick/Bulk Order Form for WooCommerce",
    "vendor": "WP Overnight",
    "versions": [
      {
        "changes": [
          {
            "at": "3.6.0",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "3.5.7",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

EPSS

0.001

Percentile

18.0%

Related for CVELIST:CVE-2023-34170