CVE-2022-4431

The WOOCS WordPress plugin, prior to version 1.3.9.4, does not validate and escape certain shortcode attributes before output, enabling Stored Cross-Site Scripting that could affect high-privilege accounts (admins) when operated by users with as little as a contributor. Root cause: insufficient o...

PT-2023-14448 · WordPress · Woocs

Name of the Vulnerable Software and Affected Versions: WOOCS WordPress plugin versions prior to 1.3.9.4 Description: The issue allows users with a role as low as contributor to perform Stored Cross-Site Scripting attacks, which could be used against high privilege users such as admins, due to the...

WOOCS < 1.3.9.4 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. PoC...