CVE-2021-25043

The WOOCS WordPress plugin before 1.3.7.3 does not sanitise and escape the customprices parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue...

CVE-2021-25043

The CVE concerns the WordPress WOOCS (Currency Switcher for WooCommerce) plugin before 1.3.7.3. Root cause: the custom_prices parameter is not sanitised/escaped before being echoed in responses, enabling reflected XSS. Impact: arbitrary script execution in a victim’s browser via crafted requests ...