Lucene search

MyungJu KimPATCHSTACK:08E0D0059AB4EBDCE697DCF2BDE19DA1

HistoryMar 31, 2023 - 12:00 a.m.

WordPress Order date time for WooCommerce Plugin <= 3.0.19 is vulnerable to Cross Site Scripting (XSS)

2023-03-3100:00:00

MyungJu Kim

patchstack.com

wordpress

woocommerce

plugin

cross site scripting

vulnerable

fixed

low severity

cve-2023-28991

patchstack

administrator

published

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

AI Score

Confidence

High

JSON

Software

Order date time for WooCommerce

Type

Plugin

Vulnerable versions

<= 3.0.19

Fixed in

3.0.20

OWASP Top 10

A7: Cross-Site Scripting (XSS)

Classification

Cross Site Scripting (XSS)

CVE

CVE-2023-28991

Patch priority

Low

CVSS severity

Low (5.9)

Developer

Claim ownership

PSID

7482ff6d1d87

Credits

MyungJu Kim

Required privilege

Administrator

Published

31 March, 2023

Expand full details Have additional information or questions about this entry? Let us know.

Solution

This security issue has a low severity impact and is unlikely to be exploited.

Affected configurations

Vulners

Node

pi_websolutionorder_date_time_for_woocommerceRange≤3.0.19

VendorProductVersionCPE
pi_websolutionorder_date_time_for_woocommerce*cpe:2.3:a:pi_websolution:order_date_time_for_woocommerce:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
pi_websolution	order_date_time_for_woocommerce	*	cpe:2.3:a:pi_websolution:order_date_time_for_woocommerce::::::::

References

wordpress.org/plugins/pi-woocommerce-order-date-time-and-type/#developers

www.cve.org/CVERecord?id=CVE-2023-28991