Lucene search

[email protected]NVD:CVE-2019-25152

HistoryJun 22, 2023 - 2:15 a.m.

CVE-2019-25152

2023-06-2202:15:47

[email protected]

web.nvd.nist.gov

cve-2019-25152

wordpress

plugins

vulnerable

cross-site scripting

stored

woocommerce

admin dashboard

unauthenticated

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

45.0%

JSON

The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 5.1.3 and 7.12.0 respectively, due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in user input that will execute on the admin dashboard.

Affected configurations

NVD

Node

tychesoftwaresabandoned_cart_lite_for_woocommerceRange<5.2.0wordpress

tychesoftwaresabandoned_cart_pro_for_woocommerceRange≤7.12.0wordpress

References

plugins.trac.wordpress.org/changeset/2033212

wpscan.com/vulnerability/9229

www.wordfence.com/blog/2019/03/xss-flaw-in-abandoned-cart-plugin-leads-to-wordpress-site-takeovers/

www.wordfence.com/threat-intel/vulnerabilities/id/a9cc5c6d-4396-4ebf-8788-f01dd9e9cfbc?source=cve

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

45.0%

JSON

Related for NVD:CVE-2019-25152

cve1 cvelist1 prion1