Lucene search
Lana CodesWPEX-ID:AD710C22-878A-441B-9C5A-90511B913D9DHistoryDec 28, 2022 - 12:00 a.m.
OneClick Chat to Order < 1.0.4.2 - Contributor+ Stored XSS via Shortcode
2022-12-2800:00:00
Lana Codes
189
woocommerce
plugin
exploit
stored xss
shortcode
0.001 Low
EPSS
Percentile
23.5%
The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
1. Install the WooCommerce Plugin.
2. Exploit: [waorder message='" onmouseover="alert(1)"']
Related
cvelist
cvelist
prion
prion
Cross site scripting
2023-01-23 15:15:00
cve
cve
CVE-2022-4760
2023-01-23 15:15:17
nvd
nvd
CVE-2022-4760
2023-01-23 15:15:17
wpvulndb
wpvulndb
OneClick Chat to Order < 1.0.4.2 - Contributor+ Stored XSS via Shortcode
2022-12-28 00:00:00