Lucene search

Emili CastellsPATCHSTACK:C5057E5C121711BBE1C05328A8B24AC5

HistoryMay 30, 2023 - 12:00 a.m.

WordPress Quick/Bulk Order Form for WooCommerce Plugin <= 3.5.7 is vulnerable to Cross Site Scripting (XSS)

2023-05-3000:00:00

Emili Castells

patchstack.com

wordpress

quick/bulk order

woocommerce

plugin

vulnerable

cross site scripting

xss

cve-2023-34170

low severity

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

AI Score

5.8

Confidence

High

JSON

Software

Quick/Bulk Order Form for WooCommerce

Type

Plugin

Vulnerable versions

<= 3.5.7

Fixed in

3.6.0

OWASP Top 10

A7: Cross-Site Scripting (XSS)

Classification

Cross Site Scripting (XSS)

CVE

CVE-2023-34170

Patch priority

Low

CVSS severity

Low (5.9)

Developer

Claim ownership

PSID

2b935e525166

Credits

Emili Castells

Required privilege

Shop Manager

Published

30 May, 2023

Expand full details Have additional information or questions about this entry? Let us know.

Solution

This security issue has a low severity impact and is unlikely to be exploited.

Affected configurations

Vulners

Node

wp_overnightquick\/bulk_order_form_for_woocommerceRange≤3.5.7

VendorProductVersionCPE
wp_overnightquick\/bulk_order_form_for_woocommerce*cpe:2.3:a:wp_overnight:quick\/bulk_order_form_for_woocommerce:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
wp_overnight	quick\/bulk_order_form_for_woocommerce	*	cpe:2.3:a:wp_overnight:quick\/bulk_order_form_for_woocommerce::::::::

References

wordpress.org/plugins/woocommerce-bulk-order-form/#developers

www.cve.org/CVERecord?id=CVE-2023-34170