Lucene search
Asif Nawaz MinhasWPEX-ID:B15744DE-BF56-4E84-9427-B5652D123C15HistoryOct 05, 2021 - 12:00 a.m.
Booking.com Product Helper < 1.0.2 - Admin+ Stored Cross-Site Scripting
2021-10-0500:00:00
Asif Nawaz Minhas
250
0.001 Low
EPSS
Percentile
24.8%
The plugin does not sanitize and escape Product Code when creating Product Shortcode, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
When creating a "New product shortcode" you can inject XSS payloads like <--`<img/src=` onerror=confirm``> --!> in the Product Code form field. When a page that includes that product's shortcode is viewed by a visitor, the payload will execute.Related
patchstack
patchstack
wpvulndb
wpvulndb
Booking.com Product Helper < 1.0.2 - Admin+ Stored Cross-Site Scripting
2021-10-05 00:00:00
cnvd
cnvd
prion
prion
Cross site scripting
2021-11-08 18:15:00
cvelist
cvelist
nvd
nvd
CVE-2021-24645
2021-11-08 18:15:08
cve
cve
CVE-2021-24645
2021-11-08 18:15:08