Product list Widget for Woocommerce <= 1.0 - Reflected XSS

2022-12-0800:00:00

cydave

143

woocommerce reflectedxss securityvulnerability ajaxexploit unauthenticatedusers authenticatedusers

0.001 Low

EPSS

Percentile

43.1%

JSON

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against both unauthenticated and authenticated users (such as high privilege one like admin).

Make any unauthenticated or authenticated users (such as a logged-in admin) open the following URL:

https://example.com/wp-admin/admin-ajax.php?action=gmwqp_change_cat&option=taxonomy&formid="></select><script>alert(`xss`)</script>

0.001 Low

EPSS

Percentile

43.1%

JSON

Related for WPEX-ID:D7F2C1C1-75B7-4AEC-8574-F38D506D064A