CVE-2021-25043

The CVE concerns the WordPress WOOCS (Currency Switcher for WooCommerce) plugin before 1.3.7.3. Root cause: the custom_prices parameter is not sanitised/escaped before being echoed in responses, enabling reflected XSS. Impact: arbitrary script execution in a victim’s browser via crafted requests ...